PatchSiren cyber security CVE debrief

CVE-2024-2378 Hitachi Energy CVE debrief

A privilege escalation vulnerability exists in the web-authentication component of Hitachi Energy SDM600 industrial control devices. The vulnerability, published on April 30, 2024, carries a CVSS 3.1 score of 8.0 (HIGH severity). Successful exploitation could allow an attacker to escalate privileges on affected installations. The attack vector is adjacent network-based, requiring low privileges but no user interaction, with high impact to confidentiality, integrity, and availability. CISA has issued advisory ICSA-24-354-02 documenting this vulnerability. Hitachi Energy has released firmware version 1.3.4 (Build Number 1.3.4.574) to address this issue.

Vendor: Hitachi Energy
Product: SDM600
CVSS: HIGH 8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-04-30
Original CVE updated: 2024-04-30
Advisory published: 2024-04-30
Advisory updated: 2024-04-30

Who should care

Asset owners and operators of Hitachi Energy SDM600 devices in industrial control and operational technology environments should prioritize this update. Security teams responsible for OT/ICS infrastructure, network administrators managing segmented industrial networks, and compliance personnel tracking CVE remediation timelines should address this vulnerability. Organizations following NERC CIP, IEC 62443, or similar industrial cybersecurity frameworks should incorporate this patch into their vulnerability management programs.

Technical summary

CVE-2024-2378 is a privilege escalation vulnerability in the web-authentication component of Hitachi Energy SDM600 devices. The CVSS 3.1 score of 8.0 reflects HIGH severity with adjacent network attack vector, high attack complexity, low privilege requirements, no user interaction, and changed scope with high impacts to confidentiality, integrity, and availability. The vulnerability exists in SDM600 versions below 1.3.4. Hitachi Energy has released firmware version 1.3.4 (Build Number 1.3.4.574) as the remediation. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Defensive priority

HIGH

Recommended defensive actions

Update SDM600 devices to firmware version 1.3.4 (Build Number 1.3.4.574) as provided by Hitachi Energy.
Apply network segmentation to limit adjacent network access to SDM600 management interfaces.
Implement defense-in-depth strategies for industrial control systems per CISA guidance.
Review and restrict user privileges to the minimum necessary for operational requirements.
Monitor for anomalous authentication attempts or privilege escalation activities on affected devices.

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSA-24-354-02. CVSS vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. Affected product confirmed as SDM600 versions below 1.3.4. Vendor fix identified as version 1.3.4 (Build Number 1.3.4.574).

Official resources

CVE-2024-2378 was disclosed on April 30, 2024, with coordinated publication by CISA and Hitachi Energy. The vulnerability affects SDM600 versions below 1.3.4.