The Cybersecurity and Infrastructure Security Agency warned that five vulnerabilities affect Hitachi Energy’s FACTS Control Platform when its GWS component is installed. The flaws can affect the confidentiality, integrity and availability of the product, according to the advisory. CISA assigns the group a maximum CVSS v3.1 base score of 9.9 and identifies energy as the affected critical-infrastructure sector.

The affected platform versions are FCP 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1. Those versions are considered affected only when the GWS component is present. Deployments without GWS are not affected by the vulnerabilities described in the advisory.

Hitachi Energy systems with GWS deployed from 2020 onward are likely affected, CISA said. The advisory lists the impacted FACTS Control deployments as SVC Light, also known as STATCOM; Fixed Series Capacitor; Thyristor Controlled Series Capacitor; Static Var Compensator; Static Watt Compensator; and Hybrid Synchronous Condensers. The affected deployments are identified as being used worldwide.

Two vulnerabilities carry critical 9.9 scores. CVE-2024-4872 concerns query validation and could allow an authenticated attacker to inject code into persistent data. The vulnerability affects all of the listed FCP versions. Its CVSS vector requires network access and low attack complexity, as well as low-level privileges, and indicates potential impacts to confidentiality, integrity and availability.

CVE-2024-3980 involves pathname handling in filesystem operations. An authenticated attacker could use the vulnerability to access or modify system files or other files critical to the application, according to the CISA advisory. It affects the same listed FCP versions as CVE-2024-4872 and has a 9.9 CVSS score.

CVE-2024-3982 is rated 8.2 and concerns session handling. An attacker with local access to the machine where the FACTS Control system with GWS is installed could enable session logging and attempt to hijack an established session. The advisory says session logging is disabled by default and that only users with administrator rights can enable it. The vulnerability affects FCP versions 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1.

CVE-2024-7940, rated 8.3, involves a service intended for local use that is exposed on all network interfaces without authentication. It affects FCP 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1. The advisory’s CVSS vector includes network access, high attack complexity and user interaction.

CVE-2024-7941 has a 4.3 score and involves a URL parameter that can redirect a request to a specified site. An attacker could modify the parameter to direct users to a malicious site, potentially supporting phishing and credential theft. The vulnerability affects FCP 3.15.0, 4.1.0 and 4.1.1.

The advisory attributes the disclosures to Hitachi Energy, which reported the vulnerabilities to CISA, and points users to Hitachi Energy security advisory 8DBD000229 for mitigation and remediation information. The advisory does not report exploitation of the flaws.

CISA’s recommended security practices call for process-control systems to be physically protected, kept off direct Internet connections and separated from other networks with firewalls exposing the minimum necessary ports. It also advises against using control systems for Internet browsing, instant messaging or email. Organizations should scan portable computers and removable media for malware before connecting them to control systems and follow proper password policies and processes. Organizations needing additional support are directed to their product provider or Hitachi Energy service organization.