PROMOD V uses plain HTTP to communicate with a third‑party Digipede server, exposing all traffic to eavesdropping, tampering, and impersonation. The flaw originates from the device’s lack of support for HTTPS, so commands and telemetry are sent without encryption or integrity verification. The primary impact is the loss of confidentiality and integrity of data transmitted between the field device and the server, allowing a network attacker to read or modify control messages and operational data.

The vulnerability affects Hitachi Energy’s PROMOD V product line. No specific firmware or hardware version details are provided, so all installations of PROMOD V that rely on the Digipede server for remote communication are potentially impacted.

The CVSS base score of 7 indicates a high severity, and because the exploit material relies only on capturing unsecured HTTP traffic, an attacker with network access can readily intercept or inject packets. The EPSS score is not available, so the current likelihood of exploitation is uncertain, but the lack of encryption makes exploitation straightforward once the attacker reaches the communication path. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploits at the time of reporting.