CVE-2024-12169 Hitachi Energy CVE debrief

Who should care

OT/ICS operators, control engineers, and patch managers using Hitachi Energy RTU500 series CMU Firmware, especially deployments with IEC 62351-3 (TLS) enabled and IEC 60870-5-104 or IEC 61850 in use.

Technical summary

CISA’s CSAF advisory ICSA-25-093-01 maps CVE-2024-12169 to RTU500 series CMU Firmware versions 13.4.1–13.4.4, 13.5.1–13.5.3, 13.6.1, and 13.7.1–13.7.4. The issue is network-reachable with low attack complexity and low privileges per CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the described effect is a CMU restart rather than data compromise. The advisory was revised on 2025-09-09 with updated fixed versions 13.5.4, 13.6.3, and 13.7.7.

Defensive priority

High for affected OT deployments where IEC 62351-3 TLS is enabled; otherwise lower priority because the advisory states the issue only applies when TLS-secured communication is in use.

Recommended defensive actions

• Upgrade affected RTU500 series CMU firmware to the vendor-fixed version identified in the latest advisory update: 13.7.7, or the corresponding fixed release for your branch (13.5.4 or 13.6.3).
• If you cannot patch immediately, apply the vendor’s general mitigation factors/workarounds from the Hitachi Energy advisory and CISA CSAF notice.
• Confirm whether IEC 62351-3 (TLS) is enabled on affected communications, since the vulnerability only applies in that configuration.
• Restrict network access to CMUs to authorized control and maintenance systems using segmentation and allow-listing consistent with ICS defense-in-depth guidance.
• Monitor for unexpected CMU restarts or service interruptions and validate recovery procedures for affected stations.
• Track the CISA advisory and vendor bulletin for any further remediation updates before maintenance windows are scheduled.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory ICSA-25-093-01, its revision history, and the referenced Hitachi Energy advisory. The supplied corpus states the vulnerability affects RTU500 controlled station and IEC 61850 functionality only when IEC 62351-3 TLS is enabled, and it lists the affected firmware ranges and remediation updates. No KEV entry is present in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.