Successful exploitation of this vulnerability, which Hitachi self-reported, could lead to a buffer overflow condition, potentially resulting in application outages (denial of service) and possible arbitrary code execution.
Hitachi Energy e-mesh EMS (Energy Management System) is an advanced software suite designed to monitor, control, and optimize distributed energy resources (DERs) such as solar panels, wind turbines, and battery storage. It helps operators stabilize power grids, maximize renewable energy usage, and minimize electricity and peak demand charges.
The following versions of Hitachi Energy e-mesh EMS suffer from the vulnerability: e-mesh EMS versions 4.1.6, 4.4.2, and 4.7.0.
NGINX Plus and NGINX Open Source used in e-mesh EMS have a vulnerability in the ngx_http_rewrite_module module. Moreover, this vulnerability exists when the rewrite directive ends up followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?).
Furthermore, an unauthenticated attacker along with conditions beyond its control can exploit this vulnerability. The attacker could send crafted HTTP requests. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. e-mesh EMS versions using NGINX v1.30.0 and below end up affected.
CVE-2026-42945 is the case number for the vulnerability, which has a CVSS V3 base score of 8.1. There is also a V4 base score of 9.2.
Energy Sector
The product sees use mainly in the energy sector, and on a global basis.
In terms of mitigations, apply hotfix for respective e-mesh EMS versions to update NGINX to either v1.30.2 or latest.
Ensure rewrite configuration does not contain “?” to replace unnamed captures, and ensure ASLR is on active (value=2) across all deployment targets covering all three versions.
Underlying Ubuntu Server 20.04 LTS is End of Life. For e-mesh EMS versions 4.1.6/4.4.2 using Ubuntu 20.04 LTS, upgrade to Ubuntu Server 22.04, or 24.04, or activate Ubuntu Pro/ESM as an interim measure.
For additional information and support, contact your product provider or Hitachi Energy service organization.
Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include:
- Process control systems remain physically protected from direct access by unauthorized personnel
- Have no direct connections to the Internet.
- Separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to end up evaluated case by case
- Process control systems should not be used for Internet surfing, instant messaging, or receiving emails
- Portable computers and removable storage media should end up carefully scanned for viruses before they connect to a control system
- Proper password policies and processes should end up followed
Additional information on Industrial Control Systems Cybersecurity Best Practices are on the Hitachi Energy “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification.