Hitachienergy CVE

Filtered by vendor Hitachienergy Subscribe

Total 70 CVE

CVE	Vendors	Products	Updated	CVSS v2	CVSS v3
CVE-2023-4518	1 Hitachienergy	6 Relion 650, Relion 650 Firmware, Relion 670 and 3 more	2024-09-23	N/A	7.5 HIGH
A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.
CVE-2024-7940	1 Hitachienergy	1 Microscada X Sys600	2024-08-28	N/A	9.8 CRITICAL
The product exposes a service that is intended for local only to all network interfaces without any authentication.
CVE-2024-2011	1 Hitachienergy	2 Foxman-un, Unem	2024-08-15	N/A	9.8 CRITICAL
A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy
CVE-2024-2012	1 Hitachienergy	2 Foxman-un, Unem	2024-08-15	N/A	9.8 CRITICAL
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allowing sensitive data to be read or modified or could cause other unintended behavior
CVE-2024-2013	1 Hitachienergy	2 Foxman-un, Unem	2024-08-15	N/A	10.0 CRITICAL
An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the services and the post-authentication attack surface.
CVE-2023-1711	1 Hitachienergy	2 Foxman-un, Unem	2024-07-25	N/A	4.4 MEDIUM
A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. If exploited an attacker could obtain confidential information. List of CPEs: * cpe:2.3:a:hitachienergy:foxman_un:R9C:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R10C:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R11A:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R11B:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R14A:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R14B:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R15A:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R15B:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R16A:::::::* * * cpe:2.3:a:hitachienergy:unem:R9C:::::::* * cpe:2.3:a:hitachienergy: unem :R10C:::::::* * cpe:2.3:a:hitachienergy: unem :R11A:::::::* * cpe:2.3:a:hitachienergy: unem :R11B:::::::* * cpe:2.3:a:hitachienergy: unem :R14A:::::::* * cpe:2.3:a:hitachienergy: unem :R14B:::::::* * cpe:2.3:a:hitachienergy: unem :R15A:::::::* * cpe:2.3:a:hitachienergy: unem :R15B:::::::* * cpe:2.3:a:hitachienergy: unem :R16A:::::::*
CVE-2023-1514	1 Hitachienergy	1 Rtu500 Scripting Interface	2024-02-05	N/A	7.5 HIGH
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.
CVE-2023-5768	1 Hitachienergy	8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more	2024-02-05	N/A	6.1 MEDIUM
A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong received APDU frame layout may cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer with wrong length information of APDU or delayed reception of data octets. Only communication link of affected HCI IEC 60870-5-104 is blocked. If attack sequence stops the communication to the previously attacked link gets normal again.
CVE-2023-5767	1 Hitachienergy	8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more	2024-02-05	N/A	6.1 MEDIUM
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to an RDT language file being improperly sanitized.
CVE-2023-5769	1 Hitachienergy	8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more	2024-02-05	N/A	6.1 MEDIUM
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to user input being improperly sanitized.
CVE-2022-3353	1 Hitachienergy	25 Fox615 Tego1, Fox615 Tego1 Firmware, Gms600 and 22 more	2024-02-04	N/A	7.5 HIGH
A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An attacker could exploit the vulnerability by using a specially crafted message sequence, to force the IEC 61850 MMS-server communication stack, to stop accepting new MMS-client connections. Already existing/established client-server connections are not affected. List of affected CPEs: * cpe:2.3:o:hitachienergy:fox61x_tego1:r15b08:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16_3:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1e01:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1d02:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1c07:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1b02:::::::* * cpe:2.3:a:hitachienergy:gms600:1.3.0:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.1.::::::: * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.5.::::::: * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0.1:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.0:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.2:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.8.0:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.0.::::::: * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.4:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.5:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.::::::: * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4.1:::::::* * cpe:2.3:a:hitachienergy:mms:2.2.3:::::::* * cpe:2.3:a:hitachienergy:pwc600:1.0:::::::* * cpe:2.3:a:hitachienergy:pwc600:1.1:::::::* * cpe:2.3:a:hitachienergy:pwc600:1.2:::::::* * cpe:2.3:o:hitachienergy:reb500:7:::::::: * cpe:2.3:o:hitachienergy:reb500:8:::::::* * cpe:2.3:o:hitachienergy:relion670:1.2.::::::: * cpe:2.3:o:hitachienergy:relion670:2.0.::::::: * cpe:2.3:o:hitachienergy:relion650:1.1.::::::: * cpe:2.3:o:hitachienergy:relion650:1.3.::::::: * cpe:2.3:o:hitachienergy:relion650:2.1.::::::: * cpe:2.3:o:hitachienergy:relion670:2.1.::::::: * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.1:::::::* * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.5:::::::* * cpe:2.3:o:hitachienergy:relion670:2.2.::::::: * cpe:2.3:o:hitachienergy:relion650:2.2.::::::: * cpe:2.3:o:hitachienergy:rtu500cmu:12..:::::::* * cpe:2.3:a:hitachienergy:rtu500cmu:13..:::::::* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:2.::::::: * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:3.0:::::::* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_5:3.0:::::::*
CVE-2021-40342	1 Hitachienergy	2 Foxman-un, Unem	2024-02-04	N/A	9.8 CRITICAL
In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. This issue affects * FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R16A:::::::* * cpe:2.3:a:hitachienergy:foxman-un:R15B:::::::* * cpe:2.3:a:hitachienergy:foxman-un:R15A:::::::* * cpe:2.3:a:hitachienergy:foxman-un:R14B:::::::* * cpe:2.3:a:hitachienergy:foxman-un:R14A:::::::* * cpe:2.3:a:hitachienergy:foxman-un:R11B:::::::* * cpe:2.3:a:hitachienergy:foxman-un:R11A:::::::* * cpe:2.3:a:hitachienergy:foxman-un:R10C:::::::* * cpe:2.3:a:hitachienergy:foxman-un:R9C:::::::* * cpe:2.3:a:hitachienergy:unem:R16A:::::::* * cpe:2.3:a:hitachienergy:unem:R15B:::::::* * cpe:2.3:a:hitachienergy:unem:R15A:::::::* * cpe:2.3:a:hitachienergy:unem:R14B:::::::* * cpe:2.3:a:hitachienergy:unem:R14A:::::::* * cpe:2.3:a:hitachienergy:unem:R11B:::::::* * cpe:2.3:a:hitachienergy:unem:R11A:::::::* * cpe:2.3:a:hitachienergy:unem:R10C:::::::* * cpe:2.3:a:hitachienergy:unem:R9C:::::::*
CVE-2022-2155	1 Hitachienergy	1 Lumada Asset Performance Management	2024-02-04	N/A	7.1 HIGH
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer. Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker. Affected versions * Lumada APM on-premises version 6.0.0.0 - 6.4.0.* List of CPEs: * cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:::::::*
CVE-2021-40335	1 Hitachienergy	2 Modular Switchgear Monitoring, Modular Switchgear Monitoring Firmware	2024-02-04	N/A	8.8 HIGH
A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF), which if exploited could lead an attacker to gain unauthorized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user. An attacker, who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., link is sent per E-Mail, could perform harmful command on MSM through its web server interface. This issue affects: Hitachi Energy MSM V2.2 and prior versions.
CVE-2022-29490	1 Hitachienergy	2 Microscada X Sys600, Sys600	2024-02-04	N/A	8.8 HIGH
Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:::::::* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:::::::* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:::::::* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:::::::* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:::::::* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:::::::* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:::::::*
CVE-2021-40336	1 Hitachienergy	2 Modular Switchgear Monitoring, Modular Switchgear Monitoring Firmware	2024-02-04	N/A	8.8 HIGH
A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per E-Mail, could trick the user into downloading malicious software onto his computer. This issue affects: Hitachi Energy MSM V2.2 and prior versions.
CVE-2021-27414	1 Hitachienergy	1 Ellipse Enterprise Asset Management	2024-02-04	4.3 MEDIUM	6.1 MEDIUM
An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather authentication credentials.
CVE-2021-27416	1 Hitachienergy	1 Ellipse Enterprise Asset Management	2024-02-04	5.8 MEDIUM	5.4 MEDIUM
An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of confidential information, or even the takeover of the user’s session.
CVE-2021-35530	1 Hitachienergy	2 Txpert Hub Coretec 4, Txpert Hub Coretec 4 Firmware	2024-02-04	7.2 HIGH	6.7 MEDIUM
A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
CVE-2021-35532	1 Hitachienergy	2 Txpert Hub Coretec 4, Txpert Hub Coretec 4 Firmware	2024-02-04	7.2 HIGH	6.7 MEDIUM
A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

Vulnerabilities (CVE)