https://vulnogram.org/ Most recent CVEs assigned by Hitachi Energy (hitachi_energy). https://vulnogram.org/seaview/icons/hitachi_energy.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-11796 https://vulnogram.org/CVE-2026-11796 Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These ser… Medium Network Exploitable Tue, 29 Sep 2026 09:50:34 GMT https://vulnogram.org/CVE-2026-7395 https://vulnogram.org/CVE-2026-7395 Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for t… High Network Exploitable Tue, 29 Sep 2026 09:45:11 GMT https://vulnogram.org/CVE-2026-8067 https://vulnogram.org/CVE-2026-8067 An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailabili… Medium Tue, 29 Sep 2026 09:33:52 GMT https://vulnogram.org/CVE-2026-8066 https://vulnogram.org/CVE-2026-8066 A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, su… Critical Network Exploitable Tue, 29 Sep 2026 09:24:05 GMT https://vulnogram.org/CVE-2026-8065 https://vulnogram.org/CVE-2026-8065 An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow t… Critical Network Exploitable Tue, 29 Sep 2026 09:20:07 GMT https://vulnogram.org/CVE-2026-17539 https://vulnogram.org/CVE-2026-17539 RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in c… Medium Network Exploitable Thu, 03 Sep 2026 07:59:47 GMT https://vulnogram.org/CVE-2026-9854 https://vulnogram.org/CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine. High Thu, 03 Sep 2026 07:55:05 GMT https://vulnogram.org/CVE-2026-9853 https://vulnogram.org/CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system… High Thu, 03 Sep 2026 07:53:35 GMT https://vulnogram.org/CVE-2026-9852 https://vulnogram.org/CVE-2026-9852 A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious cod… Medium Thu, 03 Sep 2026 07:53:06 GMT https://vulnogram.org/CVE-2026-10763 https://vulnogram.org/CVE-2026-10763 PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server. High Network Exploitable Tue, 30 Jun 2026 09:37:03 GMT https://vulnogram.org/CVE-2026-8479 https://vulnogram.org/CVE-2026-8479 IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a certain time, causing Denial of Service impact. Product is only affected if IEC 60870-5-104… Medium Tue, 26 May 2026 11:54:09 GMT https://vulnogram.org/CVE-2026-7310 https://vulnogram.org/CVE-2026-7310 A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious user with local access can exploit this vulnerability using a specially crafted XML file which may lead to memory corruption and p… Medium Tue, 26 May 2026 11:43:41 GMT https://vulnogram.org/CVE-2026-2460 https://vulnogram.org/CVE-2026-2460 A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not authorized to do so. High Tue, 24 Feb 2026 13:24:34 GMT https://vulnogram.org/CVE-2026-2459 https://vulnogram.org/CVE-2026-2459 A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so. High Tue, 24 Feb 2026 13:21:42 GMT https://vulnogram.org/CVE-2026-1773 https://vulnogram.org/CVE-2026-1773 IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality is configured. Enabling secure communication following IEC 62351-3 doe… High Network Exploitable Tue, 24 Feb 2026 13:13:17 GMT https://vulnogram.org/CVE-2026-1772 https://vulnogram.org/CVE-2026-1772 RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requires further tools like browser development utilities to access them without required privil… Medium Tue, 24 Feb 2026 13:03:23 GMT https://vulnogram.org/CVE-2025-7740 https://vulnogram.org/CVE-2025-7740 Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment. High Wed, 28 Jan 2026 09:02:21 GMT https://vulnogram.org/CVE-2025-1038 https://vulnogram.org/CVE-2025-1038 The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The inje… High Tue, 28 Oct 2025 12:17:23 GMT https://vulnogram.org/CVE-2025-1037 https://vulnogram.org/CVE-2025-1037 By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a pa… High Tue, 28 Oct 2025 12:16:36 GMT https://vulnogram.org/CVE-2025-1036 https://vulnogram.org/CVE-2025-1036 Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain… High Tue, 28 Oct 2025 12:15:29 GMT https://vulnogram.org/CVE-2025-10217 https://vulnogram.org/CVE-2025-10217 A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially carrying out further malicious attacks. Performance logging is typically en… Medium Tue, 30 Sep 2025 12:10:23 GMT https://vulnogram.org/CVE-2025-39205 https://vulnogram.org/CVE-2025-39205 A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack due to missing proper validation. High Tue, 24 Jun 2025 12:13:20 GMT https://vulnogram.org/CVE-2025-39204 https://vulnogram.org/CVE-2025-39204 A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data can leak unauthorized information to the user. High Tue, 24 Jun 2025 12:01:09 GMT https://vulnogram.org/CVE-2025-39203 https://vulnogram.org/CVE-2025-39203 A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can cause a denial of service resulting in disconnection loop. High Tue, 24 Jun 2025 11:57:04 GMT https://vulnogram.org/CVE-2025-39202 https://vulnogram.org/CVE-2025-39202 A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corruption. High Tue, 24 Jun 2025 11:51:58 GMT https://vulnogram.org/CVE-2025-39201 https://vulnogram.org/CVE-2025-39201 A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to tamper a system file, making denial of Notify service. Medium Tue, 24 Jun 2025 11:46:11 GMT https://vulnogram.org/CVE-2025-2403 https://vulnogram.org/CVE-2025-2403 A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SAM600-IO series device that if exploited could potentially cause critical functions like LDCM (Line Distance C… High Network Exploitable Tue, 24 Jun 2025 11:33:10 GMT https://vulnogram.org/CVE-2025-1718 https://vulnogram.org/CVE-2025-1718 An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to improper disk space management. High Tue, 24 Jun 2025 11:24:17 GMT https://vulnogram.org/CVE-2025-2500 https://vulnogram.org/CVE-2025-2500 A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product and the time window of a possible password attack could be expanded. Critical Network Exploitable Fri, 30 May 2025 12:29:21 GMT https://vulnogram.org/CVE-2025-1484 https://vulnogram.org/CVE-2025-1484 A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confidentiality or integrity of the system. An attacker can use this vulnerability to construct a re… Medium Fri, 30 May 2025 12:26:42 GMT https://vulnogram.org/CVE-2025-27631 https://vulnogram.org/CVE-2025-27631 The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website. Medium Network Exploitable Tue, 25 Mar 2025 12:46:08 GMT https://vulnogram.org/CVE-2025-27633 https://vulnogram.org/CVE-2025-27633 The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to compromise the confidentiality and integrity of the system. Medium Network Exploitable Tue, 25 Mar 2025 12:40:37 GMT https://vulnogram.org/CVE-2025-1445 https://vulnogram.org/CVE-2025-1445 A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations, when IEC61850 communication is active. Precondit… High Network Exploitable Tue, 25 Mar 2025 12:38:56 GMT https://vulnogram.org/CVE-2025-27632 https://vulnogram.org/CVE-2025-27632 A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning. Medium Network Exploitable Tue, 25 Mar 2025 12:37:30 GMT https://vulnogram.org/CVE-2024-12169 https://vulnogram.org/CVE-2024-12169 A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to restart the affected CMU. This vulnerability only applies, if secure commu… High Network Exploitable Tue, 25 Mar 2025 12:36:02 GMT https://vulnogram.org/CVE-2024-11499 https://vulnogram.org/CVE-2024-11499 A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a CMU restart. The vulnerability can be triggered if certificates are updated while in use on active co… Medium Tue, 25 Mar 2025 12:30:42 GMT https://vulnogram.org/CVE-2024-10037 https://vulnogram.org/CVE-2024-10037 A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection. An attacker must be properly authenticated and t… Medium Tue, 25 Mar 2025 12:22:07 GMT https://vulnogram.org/CVE-2024-9929 https://vulnogram.org/CVE-2024-9929 A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps. Medium Tue, 26 Nov 2024 13:31:02 GMT https://vulnogram.org/CVE-2024-9928 https://vulnogram.org/CVE-2024-9928 A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the equ… Medium Network Exploitable Tue, 26 Nov 2024 13:26:58 GMT https://vulnogram.org/CVE-2024-41156 https://vulnogram.org/CVE-2024-41156 Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated user… Low Tue, 29 Oct 2024 12:44:58 GMT https://vulnogram.org/CVE-2024-41153 https://vulnogram.org/CVE-2024-41153 Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root p… High Tue, 29 Oct 2024 12:30:31 GMT https://vulnogram.org/CVE-2024-7941 https://vulnogram.org/CVE-2024-7941 An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials… Medium Network Exploitable Tue, 27 Aug 2024 12:57:55 GMT https://vulnogram.org/CVE-2024-7940 https://vulnogram.org/CVE-2024-7940 The product exposes a service that is intended for local only to all network interfaces without any authentication. High Network Exploitable Tue, 27 Aug 2024 12:52:24 GMT https://vulnogram.org/CVE-2024-3982 https://vulnogram.org/CVE-2024-3982 An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level i… High Tue, 27 Aug 2024 12:47:21 GMT https://vulnogram.org/CVE-2024-3980 https://vulnogram.org/CVE-2024-3980 The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other fi… Critical Tue, 27 Aug 2024 12:42:41 GMT https://vulnogram.org/CVE-2024-4872 https://vulnogram.org/CVE-2024-4872 A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability an attacker mu… Critical Tue, 27 Aug 2024 12:37:28 GMT https://vulnogram.org/CVE-2024-28020 https://vulnogram.org/CVE-2024-28020 A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login information through complex routines to extend access on the server an… High Tue, 11 Jun 2024 18:20:35 GMT https://vulnogram.org/CVE-2024-28024 https://vulnogram.org/CVE-2024-28024 A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another control sphere. Medium Tue, 11 Jun 2024 18:17:54 GMT https://vulnogram.org/CVE-2024-28022 https://vulnogram.org/CVE-2024-28022 A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to other components in the same security… Medium Network Exploitable Tue, 11 Jun 2024 18:15:42 GMT https://vulnogram.org/CVE-2024-28023 https://vulnogram.org/CVE-2024-28023 A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code. Medium Tue, 11 Jun 2024 13:55:56 GMT