CVE-2021-40340
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedInformation Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this vulnerability can use the exposed information as a reconnaissance for further exploitation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceA misconfiguration in the ASP server of Hitachi Energy LinkOne exposes server and ASP.NET version/configuration information to unauthenticated attackers. This information leakage serves as a reconnaissance vector for further attacks.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 3.20= 3.22= 3.23= 3.24= 3.25= 3.26CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed LinkOne versionLocate the LinkOne application or service and retrieve its version information from the application itself, its installation directory, or the running service detailsAffected if The installed version matches 3.20, 3.22, 3.23, 3.24, 3.25, or 3.26
-
Confirm ASP server is enabled and accessibleDetermine whether the ASP server component of LinkOne is running and network-accessible (typically via HTTP/HTTPS on common web ports)Affected if The ASP server is active and reachable from a network perspective
-
Test for information disclosure in error responsesSend malformed or unexpected requests to the ASP server endpoint and examine the error messages returned for disclosure of server paths, version numbers, or ASP.NET configuration detailsAffected if Error responses reveal server version, file paths, ASP.NET configuration, or other sensitive system information
-
Inspect ASP server configuration settingsAccess the ASP server configuration files or admin interface and verify whether verbose error messages or detailed diagnostic information are enabledAffected if Verbose error handling or detailed server information disclosure is turned on in the configuration
A user is affected if their LinkOne version is one of the listed affected versions AND the ASP server is accessible with error messages or configuration exposing server version, paths, or ASP.NET details.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedReconfigure the ASP server to disable verbose error messages and prevent disclosure of server paths, versions, and ASP.NET configuration details. Follow secure hardening guidelines for the specific ASP server implementation.
Check with Hitachi Energy for the latest LinkOne version (3.27 or later) that may contain this configuration fix
- Disable detailed error messages in ASP.NET by setting customErrors mode to 'On' or 'RemoteOnly' in web.config
- Disable HTTP trace or debugging endpoints on the ASP server
- Ensure debug mode is disabled in the application's configuration files
- Review and harden the ASP server's security settings to prevent information disclosure
- Disable server banner/version information exposure in HTTP response headers
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation4.0 h
- Testing2.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,168.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-40340 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-40340 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data