PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-28024 Hitachi Energy CVE debrief

CVE-2024-28024 is a low-severity confidentiality issue in Hitachi Energy UNEM. According to CISA's CSAF advisory, sensitive information is stored in cleartext within a resource that might be accessible to another control sphere. The advisory lists UNEM R15A, R15B, R16A, R16B, and versions older than R15A as affected. CISA's CVSS 3.1 vector indicates local access, high privileges, and high attack complexity, with only limited confidentiality impact and no integrity or availability impact.

Vendor
Hitachi Energy
Product
UNEM
CVSS
MEDIUM 4.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-11
Original CVE updated
2024-10-29
Advisory published
2024-06-11
Advisory updated
2024-10-29

Who should care

OT/ICS administrators, system owners, and security teams responsible for Hitachi Energy UNEM deployments, especially where control-sphere separation is relied on to protect sensitive data.

Technical summary

The advisory describes cleartext storage of sensitive information in a resource that could be accessible across control spheres. The supplied CVSS vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, indicating a local, privileged, high-complexity confidentiality issue only.

Defensive priority

Low, but confirm segregation and remediate during routine OT maintenance because the issue can expose sensitive data if shared resources cross control-sphere boundaries.

Recommended defensive actions

  • Review affected UNEM instances for any sensitive data stored in cleartext and remove or relocate it to protected storage.
  • Apply the vendor's general mitigation factors for affected non-EOL releases.
  • Plan upgrades for end-of-life versions to the vendor-recommended target releases: UNEM R16B PC4 or R15B PC5, where applicable.
  • Limit access to affected resources and validate control-sphere boundaries so shared resources are not reachable from unintended zones.
  • Follow CISA ICS recommended practices and defense-in-depth guidance while applying vendor updates or mitigations.

Evidence notes

The debrief is based only on the supplied CISA CSAF advisory data and the listed official references. The advisory text states: 'A vulnerability exists in the UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another control sphere.' The affected products provided in the source are UNEM R16B, R15B, R16A, R15A, and older than R15A. The source also states that EOL versions have no remediation available and recommends updating to UNEM R16B PC4 or R15B PC5 with general mitigation factors.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-28024 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-28024

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-28024 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-28024

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-030-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.