OpenCVE

Filtered by vendor Hitachienergy Subscriptions

Total 93 CVE

CVE	Vendors	Products	Updated	CVSS v3.1
CVE-2022-3353	1 Hitachienergy	25 Fox615 Tego1, Fox615 Tego1 Firmware, Gms600 and 22 more	2024-08-03	5.9 Medium
A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An attacker could exploit the vulnerability by using a specially crafted message sequence, to force the IEC 61850 MMS-server communication stack, to stop accepting new MMS-client connections. Already existing/established client-server connections are not affected. List of affected CPEs: * cpe:2.3:o:hitachienergy:fox61x_tego1:r15b08:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16_3:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1e01:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1d02:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1c07:::::::* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1b02:::::::* * cpe:2.3:a:hitachienergy:gms600:1.3.0:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.1.::::::: * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.5.::::::: * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0.1:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.0:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.2:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.8.0:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.0.::::::: * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.4:::::::* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.5:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.::::::: * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:::::::* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4.1:::::::* * cpe:2.3:a:hitachienergy:mms:2.2.3:::::::* * cpe:2.3:a:hitachienergy:pwc600:1.0:::::::* * cpe:2.3:a:hitachienergy:pwc600:1.1:::::::* * cpe:2.3:a:hitachienergy:pwc600:1.2:::::::* * cpe:2.3:o:hitachienergy:reb500:7:::::::: * cpe:2.3:o:hitachienergy:reb500:8:::::::* * cpe:2.3:o:hitachienergy:relion670:1.2.::::::: * cpe:2.3:o:hitachienergy:relion670:2.0.::::::: * cpe:2.3:o:hitachienergy:relion650:1.1.::::::: * cpe:2.3:o:hitachienergy:relion650:1.3.::::::: * cpe:2.3:o:hitachienergy:relion650:2.1.::::::: * cpe:2.3:o:hitachienergy:relion670:2.1.::::::: * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.1:::::::* * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.5:::::::* * cpe:2.3:o:hitachienergy:relion670:2.2.::::::: * cpe:2.3:o:hitachienergy:relion650:2.2.::::::: * cpe:2.3:o:hitachienergy:rtu500cmu:12..:::::::* * cpe:2.3:a:hitachienergy:rtu500cmu:13..:::::::* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:2.::::::: * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:3.0:::::::* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_5:3.0:::::::*
CVE-2022-2513	1 Hitachienergy	6 650connectivitypackage, 670connectivitypackage, Gms600connectivitypackage and 3 more	2024-08-03	7.1 High
A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An attacker having get access to the exported backup file can exploit the vulnerability and obtain user credentials of the IEDs. Additionally, an attacker with administrator access to the PCM600 host machine can obtain other user credentials by analyzing database log files. The credentials may be used to perform unauthorized modifications such as loading incorrect configurations, reboot the IEDs or cause a denial-of-service on the IEDs.
CVE-2022-2155	1 Hitachienergy	1 Lumada Asset Performance Management	2024-08-03	5.7 Medium
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer. Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker. Affected versions * Lumada APM on-premises version 6.0.0.0 - 6.4.0.* List of CPEs: * cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:::::::*
CVE-2023-5769	1 Hitachienergy	8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more	2024-08-02	5.4 Medium
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to user input being improperly sanitized.
CVE-2023-5768	1 Hitachienergy	8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more	2024-08-02	5.9 Medium
A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong received APDU frame layout may cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer with wrong length information of APDU or delayed reception of data octets. Only communication link of affected HCI IEC 60870-5-104 is blocked. If attack sequence stops the communication to the previously attacked link gets normal again.
CVE-2023-5767	1 Hitachienergy	8 Rtu520, Rtu520 Firmware, Rtu530 and 5 more	2024-08-02	6 Medium
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to an RDT language file being improperly sanitized.
CVE-2023-5515	1 Hitachienergy	1 Esoms	2024-08-02	5.3 Medium
The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications.
CVE-2023-5514	1 Hitachienergy	1 Esoms	2024-08-02	5.3 Medium
The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local file system structure.
CVE-2023-5516	1 Hitachienergy	1 Esoms	2024-08-02	5.3 Medium
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints, backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities.
CVE-2023-2622	1 Hitachienergy	1 Modular Advanced Control For Hvdc	2024-08-02	2.7 Low
Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read.
CVE-2023-2621	1 Hitachienergy	1 Modular Advanced Control For Hvdc	2024-08-02	6.5 Medium
The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can exploit this vulnerability by uploading a crafted ZIP archive via the network to McFeeder’s service endpoint.
CVE-2023-1711	1 Hitachienergy	2 Foxman-un, Unem	2024-08-02	4 Medium
A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. If exploited an attacker could obtain confidential information. List of CPEs: * cpe:2.3:a:hitachienergy:foxman_un:R9C:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R10C:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R11A:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R11B:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R14A:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R14B:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R15A:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R15B:::::::* * cpe:2.3:a:hitachienergy:foxman_un:R16A:::::::* * * cpe:2.3:a:hitachienergy:unem:R9C:::::::* * cpe:2.3:a:hitachienergy: unem :R10C:::::::* * cpe:2.3:a:hitachienergy: unem :R11A:::::::* * cpe:2.3:a:hitachienergy: unem :R11B:::::::* * cpe:2.3:a:hitachienergy: unem :R14A:::::::* * cpe:2.3:a:hitachienergy: unem :R14B:::::::* * cpe:2.3:a:hitachienergy: unem :R15A:::::::* * cpe:2.3:a:hitachienergy: unem :R15B:::::::* * cpe:2.3:a:hitachienergy: unem :R16A:::::::*
CVE-2023-1514	1 Hitachienergy	1 Rtu500 Scripting Interface	2024-08-02	7.4 High
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.

« first previous Page 5 of 5.