Filtered by vendor Hitachienergy Subscriptions
Total 94 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-41156 1 Hitachienergy 6 Tro610, Tro610 Firmware, Tro620 and 3 more 2024-12-05 2.7 Low
Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated users with higher privilege of write access.
CVE-2024-9928 1 Hitachienergy 1 Nsd570 Firmware 2024-11-26 5.3 Medium
A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the equipment login. Note that the system supports only one concurrent session and implements a delay of more than a second between failed login attempts making it difficult to automate the attacks.
CVE-2024-2013 1 Hitachienergy 2 Foxman-un, Unem 2024-11-21 10 Critical
An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the services and the post-authentication attack surface.
CVE-2024-2012 1 Hitachienergy 2 Foxman-un, Unem 2024-11-21 9.1 Critical
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allowing sensitive data to be read or modified or could cause other unintended behavior
CVE-2024-2011 1 Hitachienergy 2 Foxman-un, Unem 2024-11-21 8.6 High
A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy
CVE-2024-28024 2 Hitachi Energy, Hitachienergy 4 Foxman-un, Unem, Foxman-un and 1 more 2024-11-21 4.1 Medium
A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another control sphere.
CVE-2024-28022 1 Hitachienergy 2 Foxman-un, Unem 2024-11-21 6.5 Medium
A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to other components in the same security realm using the targeted account.
CVE-2024-28021 1 Hitachienergy 3 Foxman-un, Foxman Un, Unem 2024-11-21 7.4 High
A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an attacker could spoof a trusted entity causing a loss of confidentiality and integrity.
CVE-2024-28020 1 Hitachienergy 2 Foxman-un, Unem 2024-11-21 8 High
A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login information through complex routines to extend access on the server and other services.
CVE-2023-6711 1 Hitachienergy 2 Rtu500, Rtu500 Firmware 2024-11-21 5.9 Medium
Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.
CVE-2023-5769 1 Hitachienergy 8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more 2024-11-21 5.4 Medium
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to user input being improperly sanitized.
CVE-2023-5768 1 Hitachienergy 8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more 2024-11-21 5.9 Medium
A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong received APDU frame layout may cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer with wrong length information of APDU or delayed reception of data octets. Only communication link of affected HCI IEC 60870-5-104 is blocked. If attack sequence stops the communication to the previously attacked link gets normal again.
CVE-2023-5767 1 Hitachienergy 8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more 2024-11-21 6 Medium
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to an RDT language file being improperly sanitized.
CVE-2023-5516 1 Hitachienergy 1 Esoms 2024-11-21 5.3 Medium
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints, backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities.
CVE-2023-5515 1 Hitachienergy 1 Esoms 2024-11-21 5.3 Medium
The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications.
CVE-2023-5514 1 Hitachienergy 1 Esoms 2024-11-21 5.3 Medium
The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local file system structure.
CVE-2023-4816 1 Hitachienergy 1 Asset Suite 2024-11-21 6.9 Medium
A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action.
CVE-2023-4518 1 Hitachienergy 6 Relion 650, Relion 650 Firmware, Relion 670 and 3 more 2024-11-21 6.5 Medium
A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.
CVE-2023-2622 1 Hitachienergy 1 Modular Advanced Control For Hvdc 2024-11-21 2.7 Low
Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read.
CVE-2023-2621 1 Hitachienergy 1 Modular Advanced Control For Hvdc 2024-11-21 6.5 Medium
The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can exploit this vulnerability by uploading a crafted ZIP archive via the network to McFeeder’s service endpoint.