Vulnerabilidades em Hitachi Energy

118 resultados
Análise Vexday

O portfólio de vulnerabilidades da Hitachi Energy apresenta um perfil de risco contido em termos de exploração ativa: nenhuma CVE consta no catálogo KEV da CISA, taxa abaixo da média geral do catálogo, e o EPSS mais elevado registrado — atribuído à CVE-2021-35534 — é de 0,0167, valor consideravelmente baixo. Das 105 CVEs catalogadas, 8 são classificadas como críticas e nenhuma possui prova de conceito pública disponível, o que reduz o risco de exploração oportunista imediata. O tipo de falha mais recorrente é CWE-20 (validação inadequada de entrada), padrão que historicamente serve de vetor para injeções e manipulação de dados em sistemas de controle industrial, merecendo atenção em revisões de código e hardening de interfaces. A chegada de 2 novas CVEs nos últimos 90 dias indica atividade de descoberta em andamento, justificando monitoramento contínuo mesmo diante do baixo nível de exploração observado.

CVE-2024-28021HIGHA vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an aEPSS 0.3%CVE-2021-35531—Remote Code Execution in TXpert Hub CoreTec 4EPSS 0.3%CVE-2024-11499MEDIUMA vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to pEPSS 0.3%CVE-2021-35528HIGHAuthentication Bypass Vulnerability Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB)EPSS 0.3%CVE-2025-27632MEDIUMA Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request EPSS 0.3%CVE-2025-27633MEDIUMThe TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection thaEPSS 0.3%CVE-2026-11796MEDIUMAsset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleREPSS 0.2%CVE-2026-106087HIGHTRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitraEPSS 0.2%CVE-2026-7395HIGHAsset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to EPSS 0.2%CVE-2025-1484MEDIUMA vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker couldEPSS 0.2%CVE-2023-1711MEDIUMA vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elemEPSS 0.2%CVE-2025-39203HIGHA vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote systemEPSS 0.2%CVE-2025-39202HIGHA vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can seeEPSS 0.2%CVE-2026-8067MEDIUMAn improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the EPSS 0.2%CVE-2021-40335MEDIUMCross Site Request Forgery (CSRF) in Hitachi Energy’s MSM ProductEPSS 0.2%CVE-2021-35530MEDIUMUser authentication bypass in TXpert Hub CoreTec 4EPSS 0.2%CVE-2024-2462MEDIUMAllow attackers to intercept or falsify data exchanges between the client and the serverEPSS 0.2%CVE-2024-3982HIGHAn attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product andEPSS 0.2%CVE-2022-3928HIGHHardcoded credential is found in the message queueEPSS 0.2%CVE-2024-2378HIGHA vulnerability exists in the web-authentication component of the SDM600. If exploited an attacker could escalate privileges on af-fected inEPSS 0.2%