PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-0400 Hitachi Energy CVE debrief

CVE-2024-0400 is a high-severity remote code execution vulnerability in Hitachi Energy MACH SCM, published 2024-03-26. An authenticated malicious client can bypass LINQ query validation to execute arbitrary code on the SCM server. Affected versions span 4.0 through 4.38.3; version 4.38.4 contains the vendor fix. No known exploitation in ransomware campaigns has been reported.

Vendor
Hitachi Energy
Product
MACH SCM
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-03-26
Original CVE updated
2025-09-30
Advisory published
2024-03-26
Advisory updated
2025-09-30

Who should care

Organizations operating Hitachi Energy MACH SCM in industrial control system environments, particularly energy sector and critical infrastructure operators. Security teams responsible for OT/ICS asset protection, system administrators managing SCM deployments, and compliance officers tracking CISA-advised vulnerabilities should prioritize assessment and remediation.

Technical summary

The vulnerability exists in MACH SCM's LINQ query execution functionality, where an authenticated System manager client can submit queries for customized filtering. Insufficient validation allows a malicious authenticated client to craft input that bypasses security checks, resulting in arbitrary code execution on the SCM server. The attack requires network access and valid authentication credentials, with high complexity due to the need for specially crafted code. Successful exploitation grants full control over the server with confidentiality, integrity, and availability impacts.

Defensive priority

high

Recommended defensive actions

  • Upgrade MACH SCM to version 4.38.4 or later to address the remote code execution vulnerability
  • Apply general mitigation factors as specified by the vendor for versions 4.0–4.5 where vendor fix is not available
  • Restrict network access to SCM server management interfaces to trusted administrative hosts only
  • Monitor SCM server logs for anomalous LINQ query execution patterns from authenticated clients
  • Implement defense-in-depth controls per CISA ICS recommended practices for industrial control systems

Evidence notes

Vulnerability description and affected product versions derived from CISA CSAF advisory ICSA-24-116-02. CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms network attack vector with high impact. Vendor fix specified for CSAFPID-0002 (versions 4.6–4.38.3).

Official resources

2024-03-26