The Cybersecurity and Infrastructure Security Agency has warned that vulnerabilities in Hitachi Energy’s FACTS Control Platform could affect the confidentiality, integrity and availability of energy-sector control systems. The advisory assigns the group a maximum CVSS v3.1 score of 9.9 and says systems with the platform’s GWS component deployed from 2020 onward are likely affected. CISA’s advisory identifies the affected deployments as equipment used worldwide.

The exposure applies only when the GWS component is present. Deployments without GWS are not affected, CISA says. The systems named in the advisory include SVC Light, also known as STATCOM; fixed series capacitor systems; thyristor-controlled series capacitor systems; static var compensators; static watt compensators; and hybrid synchronous condensers.

Eleven FACTS Control Platform versions are listed as affected: 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1. The version list applies only to installations that include GWS, according to CISA. The advisory identifies the affected product as Hitachi Energy FACTS Control Platform and places it in the energy critical-infrastructure sector.

The most severe issues could allow an authenticated attacker to inject code into persistent data or use manipulated paths and file names to access or modify system files and other files critical to the application. Those flaws are tracked as CVE-2024-4872 and CVE-2024-3980, respectively. Both carry a CVSS v3.1 score of 9.9. The first requires valid credentials, while the second involves authenticated user input controlling filesystem operations, CISA says.

Three additional vulnerabilities affect narrower version ranges or require different access conditions. CVE-2024-3982, rated 8.2, involves session hijacking after an attacker with local access enables session logging. The logging level is disabled by default, and only administrators can enable it, according to the advisory. CVE-2024-7940, rated 8.3, involves a service intended for local use that is exposed on all network interfaces without authentication. It affects versions 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1.

CVE-2024-7941 carries a medium CVSS score of 4.3 and affects versions 3.15.0, 4.1.0 and 4.1.1. A manipulated HTTP parameter can cause the web application to redirect users to a specified URL, potentially supporting phishing and credential theft. The advisory says Hitachi Energy reported the vulnerabilities to CISA.

CISA directs operators to the associated Hitachi Energy security advisory, identified as 8DBD000229, for recommended immediate actions and remediation information. General protections listed in the notice include physically securing process-control systems, avoiding direct internet connections, separating control networks with firewalls that expose as few ports as possible, maintaining password policies, and scanning portable computers and removable media before connecting them to control systems. Additional support is available through the product provider or Hitachi Energy’s service organization.