Hitachi Energy vulnerabilities, page 4
115 vulnerabilities
Known vulnerabilities in Hitachi Energy products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 60 products.
CVE-2024-2097hitachi energymach scm server+1
EPSS score0.46%
An authenticated malicious client can send a special LINQ query
to execute arbitrary code remotely (RCE) on the SCM server
from List control, and execute the arbitrary code on the same
system where SCMArchivedEventViewerTool is installed in the
case of SCM Tools.CVE-2024-2011hitachi energyfoxman-un+3EPSS score0.47%
A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that
if exploited will generally lead to a denial of service but can be used
to execute arbitrary code, which is usually outside the scope of a
program's implicit security policyCVE-2024-2462hitachi energyecst+5EPSS score0.22%
Allow attackers to intercept or falsify data exchanges between the client
and the serverCVE-2024-2377hitachi energysdm600EPSS score0.21%
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information.CVE-2024-2012hitachi energyfoxman-un+3EPSS score0.60%
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or
code to be executed on the UNEM server allowing sensitive data to
be read or modified or could cause other unintended behaviorCVE-2024-1532hitachi energyrtu500 series cmu firmwareEPSS score0.57%
A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could enforce diagnostic texts being displayed as empty strings, if an authorized user uploads a specially crafted stb-language file.CVE-2024-1531hitachi energyrtu500 series cmu firmwareEPSS score0.45%
A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could print random memory content in the RTU500 system log, if an authorized user uploads a specially crafted stb-language file.CVE-2024-41156hitachi energytro600+3EPSS score0.37%
Profile files from TRO600 series radios are extracted in plain-text
and encrypted file formats. Profile files provide potential attackers
valuable configuration information about the Tropos network. Profiles
can only be exported by authenticated users with higher privilege of write access.CVE-2024-41153hitachi energytro600+3EPSS score1.61%
Command injection vulnerability in the Edge Computing UI for the
TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the
web UI can execute commands on the device with root privileges,
far more extensive than what the write privilege intends.CVE-2024-11499hitachi energyrtu500EPSS score0.25%
A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a CMU restart. The vulnerability can be triggered if certificates are updated while in use on active connections.
The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.CVE-2024-0400hitachi energymach scmEPSS score0.63%
SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An Authenticated malicious client can send a specially crafted code to skip the validation and execute arbitrary code (RCE) on the SCM Server remotely. Malicious clients can execute any command by using this RCE vulnerability.CVE-2024-9928hitachi energynsd570 teleprotection equipmentEPSS score0.39%
A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could
cause account takeover and unauthorized access to the system
when an attacker conducts brute-force attacks against the
equipment login. Note that the system supports only one concurrent session and implements a delay of more than a second
between failed login attempts making it difficult to automate the
attacks.CVE-2024-9929hitachi energynsd570 teleprotection equipmentEPSS score0.35%
A vulnerability exists in NSD570 that allows any authenticated
user to access all device logs disclosing login information with
timestamps.CVE-2024-4872hitachi energymicroscada pro sys600+3EPSS score0.50%
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability
an attacker must have a valid credential.CVE-2024-7941hitachi energymicroscada sys600+1EPSS score0.34%
An HTTP parameter may contain a URL value and could cause
the web application to redirect the request to the specified URL.
By modifying the URL value to a malicious site, an attacker may
successfully launch a phishing scam and steal user credentials.CVE-2024-7940hitachi energymicroscada sys600+1EPSS score0.58%
The product exposes a service that is intended for local only to
all network interfaces without any authentication.CVE-2024-10037hitachi energyrtu500EPSS score0.35%
A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection.
An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability.
The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.CVE-2024-28020hitachi energyfoxman-un+3EPSS score0.37%
A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application
and server management. If exploited a malicious high-privileged
user could use the passwords and login information through complex routines to extend access on the server and other services.CVE-2024-28023hitachi energyfoxman-un+1EPSS score0.17%
A vulnerability exists in the message queueing mechanism that if
exploited can lead to the exposure of resources or functionality to
unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.CVE-2024-28024hitachi energyfoxman-un+3EPSS score0.11%
A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is
stored in cleartext within a resource that might be accessible to another control sphere.