Hitachi Energy

Hitachi Energy TRO600 series products are vulnerable to unauthorized service access via network restriction bypass and unauthenticated arbitrary file read, potentially leading to credential exposure.

Hitachi Energy MicroSCADA X SYS600 is affected by multiple vulnerabilities, including CSV injection, authentication bypass, and privilege escalation, which could allow attackers to gain unauthorized access or control over host systems.

End-of-life Hitachi Energy RTU500 CMU firmware versions 11.x and prior are susceptible to multiple critical vulnerabilities, including authentication bypass and path traversal, which could allow remote attackers to compromise device integrity or disrupt industrial control operations.

Hitachi Energy Asset Suite versions 9.9.0 and prior are susceptible to unauthenticated access to sensitive servlets, enabling unauthorized configuration file uploads and denial-of-service conditions.

Hitachi Energy RTU500 series devices are affected by multiple vulnerabilities including CVE-2024-45305 through CVE-2024-45311, which may allow remote, unauthenticated attackers to achieve arbitrary code execution, bypass security, or cause denial-of-service.

Hitachi Energy FACTS Control Platform (FCP) units equipped with the GWS component are affected by multiple critical vulnerabilities, including path traversal and authentication bypass, potentially leading to unauthorized system access or modification.

Hitachi Energy RTU500 devices are impacted by multiple vulnerabilities that allow attackers to induce Denial-of-Service, exfiltrate authentication credentials, and bypass security controls.

Hitachi Energy PROMOD V versions 1.0.10 and prior are affected by CVE-2026-10763, an insecure HTTP transmission vulnerability that allows attackers to intercept or manipulate sensitive data in transit, potentially leading to credential theft, session hijacking, or unauthorized access, impacting the energy sector globally.

CISA published ICS advisories addressing vulnerabilities in products from ABB, Hitachi Energy, Kieback & Peter, ScadaBR, Siemens, and ZKTeco, recommending mitigations and updates.

Hitachi Energy GMS600 versions 1.3.0 and 1.3.1 are affected by CVE-2022-4304, a vulnerability in the OpenSSL RSA Decryption implementation; an attacker could exploit this timing-based side channel to recover plaintext across a network in a Bleichenbacher-style attack by sending trial messages to the server and recording processing times, eventually decrypting application data.

A remote code execution vulnerability (CVE-2026-34197) in Apache ActiveMQ Classic allows authenticated attackers to invoke management operations through the Jolokia API to retrieve a remote configuration file and execute OS commands, potentially exploitable without authentication via CVE-2024-32114.