The vulnerabilities are improper neutralization of special elements in data query logic, improper limitation of a pathname to a restricted directory (path traversal), authentication bypass by capture-replay, missing authentication for critical function, and URL redirection to untrusted site (open redirect).
An attacker exploiting these vulnerabilities, which Hitachi self-reported, can cause impact on confidentiality, integrity and availability of the product.
Hitachi Energy FACTS Control Platform is the industrial control and management system used to operate Flexible Alternating Current Transmission Systems (FACTS), which stabilize and optimize high-voltage power grids.
The following FACTS Control systems with GWS component deployed from year 2020 onwards could end up affected:
- SVC Light (STATCOM)
- Fixed Series Capacitor
- Thyristor Controlled Series Capacitor
- Static Var Compensator
- Static Watt Compensator
- Hybrid Synchronous Condensers
Affected FCP versions are only applicable if GWS component is present.
Vulnerable Versions
The following versions of Hitachi Energy FACTS Control Platform (FCP) suffer from the vulnerabilities: FACTS Control Platform (FCP) 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0, and 4.1.1.
The product sees use mainly in the energy sector, and on a global basis.
In one issue, a vulnerability exists in the query validation of the FACTS Control system with GWS component. If exploited this could allow an authenticated attacker to inject code toward persistent data. Note that to successfully exploit this vulnerability an attacker must have a valid credential.
CVE-2024-4872 is the case number for the vulnerability, which has a CVSS base score of 9.9.
Additionally, the FACTS Control system with GWS allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application.
CVE-2024-3980 is the case number for the vulnerability, which has a CVSS base score of 9.9.
Also, an attacker with local access to machine where FACTS Control system with GWS installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. Note: By default, the session logging level does not end up enabled and only users with administrator rights can enable it.
CVE-2024-3982 is the case number for the vulnerability, which has a CVSS base score of 8.2.
Meanwhile, the FACTS Control system with GWS product exposes a service intended for local only to all network interfaces without any authentication.
CVE-2024-7940 is the case number for the vulnerability, which has a CVSS base score of 8.3.
Phishing for Credentials
Furthermore, a vulnerability exists in FACTS Control system with GWS where a HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
CVE-2024-7941 is the case number for the vulnerability, which has a CVSS base score of 4.3.
In terms of mitigations, recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include process control systems end up physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and remain separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to undergo evaluation on a case by case basis.
Additionally, users should not use process control systems for Internet surfing, instant messaging, or receiving emails. Portable computers and removable storage media should end up carefully scanned for viruses before they connect to a control system. Moreover, users should follow proper password policies and processes.
Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification.
For more information see the associated Hitachi Energy security advisory 8DBD000229.