Hitachi Energy vulnerabilities, page 5
115 vulnerabilities
Known vulnerabilities in Hitachi Energy products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 60 products.
HighCVE-2024-28021hitachi energy · foxman-un +4 morehitachi energy foxman-unA vulnerability exists in the FOXMAN-UN/UNEM server that affects the message
queueing mechanism’s certificate validation. If exploited an attacker could spoof a trusted entity causing a loss of confidentiality
and integrity.EPSS0.27%MediumCVE-2024-28022hitachi energy · foxman-un +3 morehitachi energy foxman-unA vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of
authentication attempts using different passwords, and eventually
gain access to other components in the same security realm using
the targeted account.EPSS0.36%HighCVE-2024-12169hitachi energy · rtu500hitachi energy rtu500A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to restart the affected CMU. This vulnerability only applies, if secure communication using IEC 62351-3 (TLS) is enabled.EPSS0.40%HighCVE-2024-3982hitachi energy · microscada sys600 +1 morehitachi energy microscada sys600An attacker with local access to machine where MicroSCADA X
SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level
is not enabled and only users with administrator rights can enable it.EPSS0.22%CriticalCVE-2024-3980hitachi energy · microscada pro sys600 +3 morehitachi energy microscada pro sys600The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names
that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or
other files that are critical to the application.EPSS0.61%HighCVE-2026-2460hitachi energy · relion reb500 +1 morehitachi energy relion reb500A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not authorized to do so.EPSS0.31%HighCVE-2026-2459hitachi energy · relion reb500 +1 morehitachi energy relion reb500A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.EPSS0.37%HighCVE-2026-1773hitachi energy · rtu500 series cmu firmware +4 morehitachi energy rtu500 series cmu firmwareIEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality is configured. Enabling secure communication following IEC 62351-3 does not remediate the vulnerability but mitigates the risk of exploitation.EPSS0.46%MediumCVE-2026-1772hitachi energy · rtu500 series cmu firmware +4 morehitachi energy rtu500 series cmu firmwareRTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requires further tools like browser development utilities to access them without required privileges.EPSS0.29%MediumCVE-2026-11796hitachi energy · asset suitehitachi energy asset suiteAsset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific functions within production environment depending on how the Asset Suite application is configured.EPSS0.25%HighCVE-2026-9854hitachi energy · microscada sys600 +1 morehitachi energy microscada sys600A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.EPSS0.14%HighCVE-2026-9853hitachi energy · microscada sys600 +1 morehitachi energy microscada sys600A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself.
Only the SYS600 system users should be permitted to view and modify application objects.EPSS0.14%HighCVE-2026-9852hitachi energy · microscada sys600 +1 morehitachi energy microscada sys600A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.EPSS0.21%MediumCVE-2026-17539hitachi energy · rtu500 series cmu firmwarehitachi energy rtu500 series cmu firmwareRTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.EPSS0.27%HighCVE-2026-7395hitachi energy · asset suitehitachi energy asset suiteAsset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.EPSS0.25%MediumCVE-2026-7310hitachi energy · mach hidrawhitachi energy mach hidrawA heap-based buffer overflow vulnerability exists in XML
parser functionality in the HiDraw. An authenticated
malicious user with local access can exploit this
vulnerability using a specially crafted XML file which may
lead to memory corruption and potential arbitrary code
execution. Successful exploitation could result in
application crashes (denial of service) and compromise the
confidentiality and integrity of the affected system.EPSS0.13%HighCVE-2026-10763hitachi energy · promod vhitachi energy promod vPROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server.EPSS0.43%MediumCVE-2026-8479hitachi energy · rtu500 series cmu firmwarehitachi energy rtu500 series cmu firmwareIEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable
for a NULL pointer dereferencing, if a specially crafted
sequence of messages is sent for a certain time, causing
Denial of Service impact.
Product is only affected if IEC 60870-5-104 functionality in
bidirectional mode (BCI) is configured.EPSS0.25%CriticalCVE-2026-8065hitachi energy · rtu500 series cmu firmwarehitachi energy rtu500 series cmu firmwareAn authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.EPSS0.58%MediumCVE-2026-8067hitachi energy · rtu500 series cmu firmwarehitachi energy rtu500 series cmu firmwareAn improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.EPSS0.32%