These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in RTU500 may cause a NULL pointer dereference in the last entry of the enhanced message queue under high-load scenarios, such as sending GI requests at short intervals. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.
PROMOD V, a product from Hitachi Energy, is vulnerable to insecure HTTP communication instead of HTTPS due to the lack of HTTPS support from a 3rd party Digipede server. This vulnerability, tracked as CVE-2026-10763, has a CVSS score of 7.1 and is classified as HIGH severity. The affected product versions are 1.0.10 and prior, and the recommended mitigation is to upgrade to version 1.0.11 and enable HTTPS [truncated]
CVE-2026-8479 describes a NULL pointer dereference vulnerability in IEC 60870-5-104 bidirectional mode (BCI) within Hitachi Energy's RTU500 product. The vulnerability can be triggered by a specially crafted sequence of messages sent over a sustained period, resulting in Denial of Service (DoS) impact. The attack requires network adjacency (AV:A) and low attack complexity, with the primary impact being ava [truncated]
A heap-based buffer overflow vulnerability exists in the XML parser functionality of HiDraw software. The vulnerability, assigned CVSS 4.0 score 4.4 (Medium), requires an authenticated attacker with local access to exploit using a specially crafted XML file. Successful exploitation may lead to memory corruption, potential arbitrary code execution, application crashes resulting in denial of service, and co [truncated]
CVE-2026-32776 is a medium-severity vulnerability in Hitachi Energy's RTU500 series CMU Firmware. The vulnerability is caused by a NULL pointer dereference in libexpat before 2.7.5, which can lead to a Denial of Service (DoS) impact. The product is only affected if IEC 61850 functionality is configured. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 5.5, indicating a medium [truncated]
CVE-2026-2460 is a medium-severity authorization issue in Hitachi Energy Relion REB500. According to the CISA-republished Hitachi Energy advisory, a low-privileged authenticated user may use the DAC protocol to access and alter directory content without being authorized to do so. The vendor remediation is to update to version 8.3.3.1.
CVE-2026-2459 is an authorization weakness in Hitachi Energy Relion REB500. The CISA-republished advisory states that an authenticated user with the Installer role can access and alter directory contents outside the role’s authorized scope. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, indicating concern primarily for confidentiality and integrity rather than availability. Hitachi [truncated]
CVE-2026-1773 is a high-severity denial-of-service vulnerability affecting Hitachi Energy RTU500 series CMU Firmware when IEC 60870-5-104 bi-directional functionality is configured. According to the CISA advisory, reception of an invalid U-format frame can trigger a DoS condition. The issue was publicly disclosed on 2026-02-24 and the advisory was republished on 2026-03-03 after CISA incorporated the vend [truncated]
CVE-2026-1772 is a confidentiality issue in the RTU500 web interface. The advisory states that an unprivileged user can read user management information using browser development utilities, even though the data is not exposed through the normal RTU500 web UI. CISA’s advisory assigns CVSS 3.1 4.3/Medium and points to firmware updates as the primary fix.
CVE-2025-7740 is a High-severity default credentials weakness in Hitachi Energy SuprOS. According to the advisory summary, an authenticated local attacker could use this issue to gain access through an admin account created during product deployment. The vendor and CISA guidance focus on removing unwanted accounts, changing default passwords, and applying the recommended update.
CVE-2024-28757 is a medium-severity availability issue in Hitachi Energy RTU500 series components that use libexpat for IEC 61850 client and server processing. According to the CISA CSAF advisory published on 2025-09-16, an authenticated and authorized malicious user could load crafted XML input that may cause memory mismanagement and potentially reboot the RTU500. Hitachi Energy’s remediation guidance ca [truncated]
CVE-2025-23184 is a network-reachable denial-of-service issue associated with Apache CXF versions before 3.5.10, 3.6.5, and 4.0.6. In edge cases, CachedOutputStream instances may not be closed and can fill temporary filesystems, affecting both servers and clients. In the supplied advisory corpus, Hitachi Energy maps this issue to Asset Suite and recommends upgrading to version 9.7 and applying vendor miti [truncated]
CVE-2022-44729 is a high-severity SSRF issue disclosed in CISA’s advisory for Hitachi Energy Asset Suite. The advisory says Apache XML Graphics Batik 1.16 can, by default, load external resources from a malicious SVG, which may lead to resource consumption and in some cases information disclosure. The supplied remediation is to upgrade Asset Suite to version 9.7 and apply the advisory’s general mitigation factors.
CVE-2025-39202 is a high-severity vulnerability in Hitachi Energy MicroSCADA Pro/X SYS600 affecting the Monitor Pro and Supervision log components. According to CISA’s advisory, a local authenticated low-privilege user can see and overwrite files, which can lead to information leakage and data corruption. Hitachi Energy identifies version 10.7 as the fixed release for affected systems.
CVE-2025-2403 is a high-severity availability issue in Hitachi Energy Relion 670/650 and SAM600-IO series devices. CISA describes it as an improper prioritization of network traffic over a protection mechanism that could let a denial-of-service condition interfere with critical functions such as the Line Distance Communication Module (LDCM). The advisory was published on 2025-06-24 and later updated on 20 [truncated]
CVE-2025-1718 is an availability-impacting vulnerability in Hitachi Energy Relion 670/650 and SAM600-IO series devices. According to the advisory, an authenticated user with file access privilege via FTP can cause the device to reboot because of improper disk space management. The issue was publicly disclosed in CISA’s CSAF advisory on 2025-06-24 and later republished with updates through 2026-02-05. The [truncated]
CVE-2024-3596 is a critical RADIUS forgery issue affecting Hitachi Energy XMC20. The advisory says a valid RADIUS response under RFC 2865 can be transformed into another response type by a chosen-prefix collision attack against the MD5 Response Authenticator signature. Hitachi Energy and CISA recommend enabling the RADIUS Message-Authenticator option on both the XMC20 and the RADIUS server, and updating t [truncated]
CVE-2025-2500 is a HIGH-severity vulnerability in Hitachi Energy Asset Suite SOAP web services. The public advisory says successful exploitation could lead to unauthorized access to the product and expand the time window for a possible password attack. The advisory scope in the supplied corpus is limited to Asset Suite version 9.6.4.4 and Asset Suite version 9.7, with mitigation guidance focused on genera [truncated]
CVE-2025-1484 is a medium-severity vulnerability in the media upload component of Hitachi Energy Asset Suite. CISA’s advisory states that successful exploitation could affect confidentiality or integrity, and that an attacker can construct a request that causes attacker-supplied JavaScript to execute in a user’s browser within that user’s session. The affected product listed in the advisory is Asset Suite [truncated]
CISA published advisory ICSA-25-196-01 on 2025-04-29 for CVE-2019-9429. The supplied source data describes a memory corruption issue in the profman component that can trigger an out-of-bounds write and potentially lead to unauthorized local escalation of privileges. The affected product is identified in the source metadata as Asset Suite AnyWhere for Inventory (AWI) Android mobile app versions 11.5 (awi_1 [truncated]
CVE-2019-9290 is a high-severity issue affecting Hitachi Energy’s Asset Suite-related Android mobile app deployment described in the advisory as Asset Suite AnyWhere for Inventory (AWI) Android mobile app versions 11.5 and earlier. The problem is a tzdata component mismatch between allocation and deallocation functions that can corrupt memory and may allow a local attacker to escalate privileges. CISA pub [truncated]
CVE-2019-9262 is a high-severity vulnerability affecting Hitachi Energy Asset Suite AnyWhere for Inventory (AWI) Android mobile app versions 11.5 (awi_11.5_armv7) and earlier, as described in the 2025 CISA advisory. The issue is in the MPEG4Extractor component of the media extractor and could allow an attacker to trigger an out-of-bounds write, which may lead to remote code execution. The supplied advisor [truncated]
Hitachi Energy TRMTracker is affected by a reflected cross-site scripting (XSS) vulnerability. According to the CISA CSAF advisory, the issue can allow client-side code injection, which may affect the confidentiality and integrity of the application. The advisory identifies affected TRMTracker branches as 6.2.04 and below, and 6.3.0 and 6.3.01, with vendor updates available.
CVE-2025-27632 is a medium-severity Host Header Injection vulnerability in Hitachi Energy TRMTracker. According to CISA’s advisory, an attacker who can influence the Host header in an HTTP request may be able to leverage multiple attack vectors, including defacing site content through web-cache poisoning. Hitachi Energy and CISA both published guidance on 2025-03-25, and affected versions include TRMTrack [truncated]
CVE-2025-27631 is a medium-severity vulnerability in Hitachi Energy TRMTracker. CISA’s advisory describes an LDAP injection flaw in the TRMTracker web application that could let an attacker manipulate a query and potentially read or update website data, with the advisory also stating remote command execution may be possible. The issue affects TRMTracker versions 6.2.04 and below as well as 6.3.0 and 6.3.0 [truncated]
CVE-2025-1445 is a high-severity availability issue in Hitachi Energy RTU500 CMU Firmware when IEC 61850 is configured to use TLS and an open connection renegotiates during active communication. The advisory ties impact to specific timing conditions and to the CMU hosting the IEC 61850 stack. Hitachi Energy and CISA recommend upgrading to the fixed firmware and applying the advisory’s general mitigation f [truncated]
CVE-2024-12169 is an availability-focused vulnerability in Hitachi Energy RTU500 CMU firmware. When IEC 62351-3 secure communication (TLS) is enabled, a specific attack sequence against IEC 60870-5-104 controlled station or IEC 61850 functionality can restart the affected CMU.
CVE-2024-11499 is a medium-severity availability issue in Hitachi Energy RTU500 Series CMU Firmware. According to the CISA CSAF advisory, an authenticated and authorized attacker can trigger a CMU restart when certificates are updated while they are in use on active connections. The CMU is described as automatically recovering after a successful exploit, but the restart can still interrupt service. The ad [truncated]
CVE-2024-10037 is an authenticated denial-of-service issue in Hitachi Energy RTU500 CMU Firmware. A specially crafted message sequence over a WebSocket connection can disrupt the RTU500 CMU application when RTU500 test mode is enabled. The impact is availability-only and the affected CMU is reported to auto-recover, but the flaw still warrants remediation in OT environments.
CVE-2024-7940 is a High-severity Hitachi Energy MACH GWS issue disclosed by CISA on 2025-02-25. The advisory says a service intended for local-only access was exposed to all network interfaces without authentication. Hitachi Energy identifies MACH GWS versions 3.1.0.0 through 3.3.0.0 as affected and recommends upgrading to 3.4.0.0 or coordinating mitigation options with the local account team.