PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-0400 Hitachi Energy CVE debrief

CVE-2024-0400 is a high-severity remote code execution vulnerability in Hitachi Energy MACH SCM, published 2024-03-26. An authenticated malicious client can bypass LINQ query validation to execute arbitrary code on the SCM server. Affected versions span 4.0 through 4.38.3; version 4.38.4 contains the vendor fix. No known exploitation in ransomware campaigns has been reported.

Vendor
Hitachi Energy
Product
MACH SCM
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-03-26
Original CVE updated
2025-09-30
Advisory published
2024-03-26
Advisory updated
2025-09-30

Who should care

Organizations operating Hitachi Energy MACH SCM in industrial control system environments, particularly energy sector and critical infrastructure operators. Security teams responsible for OT/ICS asset protection, system administrators managing SCM deployments, and compliance officers tracking CISA-advised vulnerabilities should prioritize assessment and remediation.

Technical summary

The vulnerability exists in MACH SCM's LINQ query execution functionality, where an authenticated System manager client can submit queries for customized filtering. Insufficient validation allows a malicious authenticated client to craft input that bypasses security checks, resulting in arbitrary code execution on the SCM server. The attack requires network access and valid authentication credentials, with high complexity due to the need for specially crafted code. Successful exploitation grants full control over the server with confidentiality, integrity, and availability impacts.

Defensive priority

high

Recommended defensive actions

  • Upgrade MACH SCM to version 4.38.4 or later to address the remote code execution vulnerability
  • Apply general mitigation factors as specified by the vendor for versions 4.0–4.5 where vendor fix is not available
  • Restrict network access to SCM server management interfaces to trusted administrative hosts only
  • Monitor SCM server logs for anomalous LINQ query execution patterns from authenticated clients
  • Implement defense-in-depth controls per CISA ICS recommended practices for industrial control systems

Evidence notes

Vulnerability description and affected product versions derived from CISA CSAF advisory ICSA-24-116-02. CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms network attack vector with high impact. Vendor fix specified for CSAFPID-0002 (versions 4.6–4.38.3).

Sources and references

Verified primary and authoritative sources

  • CVE-2024-0400 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-0400

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-0400 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-0400

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-116-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-116-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.