Hitachi Energy vulnerabilities
118 CVEs and advisories name Hitachi Energy as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-2617A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update, if secure update feature
- CVE-2024-2377A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600.
- CVE-2024-2097An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control
- CVE-2024-0400SCM Software is a client and server application.
- CVE-2024-1532A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below.
- CVE-2024-1531A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below.
- CVE-2024-2244REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successfu
- CVE-2022-3864 A vulnerability exists in the Relion update package signature validation.
- CVE-2022-2081A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above.
- CVE-2023-6711Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below.
- CVE-2023-1514A vulnerability exists in the component RTU500 Scripting interface.
- CVE-2023-5769 A vulnerability exists in the webserver that affects the RTU500 series product versions listed below.
- CVE-2023-5768A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below.
- CVE-2023-5767 A vulnerability exists in the webserver that affects the RTU500 series product versions listed below.
- CVE-2023-4518A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a
- CVE-2023-5516 Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing informatio
- CVE-2023-5515 The responses for web queries with certain parameters disclose internal path of resources.
- CVE-2023-5514 The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enume
- CVE-2023-2622 Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup servic
- CVE-2023-2621 The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer syst
- CVE-2023-4816A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214.
- CVE-2022-4608A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product.
- CVE-2022-2502A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product.
- CVE-2023-2625A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, havi
- CVE-2023-1711A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elem
- CVE-2022-3685SDM600 software privilege level
- CVE-2022-3686SDM600 API permission check
- CVE-2022-3684SDM600 endpoint vulnerability
- CVE-2022-3683SDM600 API web services authorization validation
- CVE-2022-3682SDM600 file permission validation