Hitachi Energy FACTS Control Platform (FCP)
CISA republished Hitachi Energy's advisory on five flaws, including two critical CVSS 9.9 issues, in the FACTS Control Platform GWS component for grid systems.
CISA republished Hitachi Energy's advisory for the FACTS Control Platform (FCP) with the GWS component, versions 3.4.0 through 4.1.1, deployed in energy infrastructure such as SVC Light STATCOMs, series capacitors, and synchronous condensers. Five issues are covered: CVE-2024-4872 authenticated query injection (CVSS 9.9), CVE-2024-3980 path traversal (9.9), CVE-2024-3982 capture-replay authentication bypass (8.2), CVE-2024-7940 unauthenticated exposed local service (8.3), and CVE-2024-7941 open redirect. Deployments from 2020 onwards that include the GWS component are likely affected, and vendor mitigation guidance is provided.
- CVE-2024-4872 and CVE-2024-3980 are critical flaws scoring 9.9 (CVSS v3.1)
- Issues include query injection, path traversal, capture-replay bypass, missing authentication, open redirect
- FCP versions 3.4.0 through 4.1.1 with GWS component deployed since 2020 are affected
- Impacts STATCOMs, series capacitors, and synchronous condensers in the energy sector
- Tags
- authentication-bypasscisaenergyfacts-control-platformhitachi-energyicsopen-redirectpath-traversal
- Vendors
- Hitachi EnergyCISA
- Products
- FACTS Control PlatformGWS
- Organizations
- Hitachi EnergyCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-3980+1 related CVE | The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations | 8.8 | <1% | ||
CVE-2024-7940+2 related CVEs | The product exposes a service that is intended for local only to all network interfaces without any authentication | 9.8 group max | <1% |
From the original article
7 min read at cisa.govView CSAF Summary Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker exploiting these vulnerabilities can cause impact on confidentiality, integrity and availability of the product. Following FACTS Control systems with GWS component deployed from year 2020 onwards are likely affected by the above vulnerabilities.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.