The vulnerability exists in Hitachi Energy Asset Suite, where unauthenticated users can request the PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet. These servlets perform administrative functions such as reloading configuration and flushing caches. Because authentication is not required, an attacker can repeatedly invoke them, leading to resource exhaustion or loss of cached data and thus service interruption. The issue is a missing authentication check, identified as CWE‑306; it directly impacts availability.

Hitachi Energy Asset Suite. No specific version numbers are listed, so all installations that expose the affected servlets are vulnerable.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1 % shows a very low likelihood of exploitation. The vulnerability is not catalogued in CISA KEV. Attack is likely carried out over a network connection to the exposed URLs, requires no credentials, and would result in application unavailability. No additional active conditions are mentioned in the description.