Hitachi Energy’s FACTS Control Platform has five vulnerabilities that could affect the confidentiality, integrity and availability of energy-control systems using the platform’s GWS component, according to a Cybersecurity and Infrastructure Security Agency advisory. The affected systems include FACTS Control deployments associated with SVC Light, fixed series capacitors, thyristor-controlled series capacitors, static var compensators, static watt compensators and hybrid synchronous condensers.

The exposure is limited to deployments that include GWS. Systems deployed from 2020 onward are likely affected, while deployments without the GWS component are not affected. The advisory identifies the affected FACTS Control Platform versions as 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1. The listed versions apply only when the GWS component is present.

The highest-rated issue, CVE-2024-4872, carries a CVSS 3.1 score of 9.9 and is classified as critical. It involves query validation in the FACTS Control system with GWS. An authenticated attacker could use the vulnerability to inject code toward persistent data. Successful exploitation requires a valid credential.

Another critical-rated vulnerability, CVE-2024-3980, also carries a CVSS score of 9.9. It involves path traversal, allowing an authenticated user’s input to control or influence paths or file names used in filesystem operations. An attacker could use the flaw to access or modify system files and other files critical to the application.

The remaining vulnerabilities affect narrower sets of versions or require specific conditions. CVE-2024-3982 affects versions 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1 and 4.1.1. It involves session hijacking after an administrator enables session logging. The logging level is not enabled by default, and exploitation requires local access to the machine where the FACTS Control system with GWS is installed. CISA rates the issue high, with a CVSS score of 8.2.

CVE-2024-7940 affects versions 3.14.0, 3.15.0 and 4.0.0 through 4.1.1. The FACTS Control system with GWS exposes a service intended for local use across all network interfaces without authentication. CISA assigns the vulnerability a high CVSS score of 8.3.

CVE-2024-7941 affects versions 3.15.0, 4.1.0 and 4.1.1. The flaw allows an HTTP parameter to contain a URL value that can redirect a request to a specified destination. A malicious URL could send users to a phishing site and expose their credentials. The issue has a medium CVSS score of 4.3.

The advisory lists the affected technology under the energy critical-infrastructure sector and identifies deployments in countries and areas worldwide. Hitachi Energy reported the vulnerabilities to CISA. The associated Hitachi Energy security advisory is identified as 8DBD000229.

CISA’s general mitigation guidance includes physically restricting access to process-control systems, avoiding direct Internet connections and separating control networks from other networks with firewalls that expose as few ports as possible. The guidance also calls for following proper password policies and processes, avoiding Internet surfing, instant messaging and email use on process-control systems, and scanning portable computers and removable storage media for malware before connecting them to control systems. The advisory directs users seeking additional information and support to their product provider or Hitachi Energy’s service organization.