Hitachi Energy vulnerabilities
118 CVEs and advisories name Hitachi Energy as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-3353IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products
- CVE-2022-2155A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role.
- CVE-2022-3929Communication between the client and server partially using CORBA over TCP/IP
- CVE-2022-3928Hardcoded credential is found in the message queue
- CVE-2022-3927The affected products store public and private key that are used to sign and protect custom parameter set files from modification.
- CVE-2021-40342Use of default key for encryption
- CVE-2021-40341Weak DES encryption
- CVE-2022-2513Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products
- CVE-2022-3388Input Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 Products
- CVE-2022-29492A vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected conne ...
- CVE-2022-1778A vulnerability exists during the start of the affected SYS600, where an input validation flaw causes a buffer-overflow while reading a specific configuration file. Subsequently SYS600 will fail to start. The configuration file can only be accessed by ...
- CVE-2022-29922A vulnerability exists in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS ...
- CVE-2022-2277A vulnerability exists in the ICCP stack of the affected SYS600 versions due to validation flaw in the process that establishes the ICCP communication. The validation flaw will cause a denial-of-service when ICCP of SYS600 is request to forward any da ...
- CVE-2022-29490A vulnerability exists in the Workplace X WebUI in which an authenticated user is able to execute any MicroSCADA internal scripts irrespective of the authenticated user's role.
- CVE-2021-40336HTTP Response Splitting in Hitachi Energy’s MSM Product
- CVE-2021-40335Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product
- CVE-2021-35530User authentication bypass in TXpert Hub CoreTec 4
- CVE-2021-35531Remote Code Execution in TXpert Hub CoreTec 4
- CVE-2021-35532Firmware upload verification bypass in TXpert Hub CoreTec 4
- CVE-2022-28613Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series
- CVE-2021-40337OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product
- CVE-2021-40333Weak default credential associated with TCP port 26
- CVE-2021-40334SSH activation problem in the proprietary management protocol (port TCP 5558)
- CVE-2021-35533Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series
- CVE-2021-35534Insufficient Security Control Vulnerability
- CVE-2021-35535Insufficient Security Control Vulnerability
- CVE-2021-35528Authentication Bypass Vulnerability Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB)
- CVE-2021-22278Certificate verification vulnerability in Update Manager of PCM600 Engineering Tool