Republished vendor advisory. This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000212 from a direct conversion of their vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…
General Mitigation Factors/Workarounds: Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
Credit: Hitachi Energy PSIRT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2019-9256 | CWE-787 Out-of-bounds Write | 8.8 High |
A vulnerability exists in the libmediaextractor component. If successfully exploited, an attacker could trigger an out-of-bounds write due to an integer overflow, potentially leading to remote code execution. Mitigation: Apply General Mitigation Factors/Workarounds Affected, fixed & timelineAffected:
|
| CVE-2019-9262 | CWE-787 Out-of-bounds Write | 8.8 High |
A vulnerability exists in the MPEG4Extractor component of the media extractor. If successfully exploited, an attacker could trigger an out-of-bounds write, potentially leading to remote code execution. Mitigation: Apply General Mitigation Factors/Workarounds Affected, fixed & timelineAffected:
|
| CVE-2019-9290 | CWE-763 Release of Invalid Pointer or Reference | 7.8 High |
A vulnerability exists in the tzdata component due to a mismatch between allocation and deallocation functions. If successfully exploited, an attacker could trigger memory corruption, potentially leading to local escalation of privilege. Mitigation: Apply General Mitigation Factors/Workarounds Affected, fixed & timelineAffected:
|
| CVE-2019-9429 | CWE-787 Out-of-bounds Write | 7.8 High |
A vulnerability exists in the profman component due to memory corruption. If successfully exploited, an attacker could trigger an out-of-bounds write, potentially leading to unauthorized local escalation of privileges. Mitigation: Apply General Mitigation Factors/Workarounds Affected, fixed & timelineAffected:
|
| CVE-2025-2500 | CWE-256 Plaintext Storage of a Password | 7.4 High |
A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product and the time window of a possible password attack could be expanded. Mitigation: Apply General Mitigation Factors/Workarounds Affected, fixed & timelineAffected:
|
| CVE-2025-1484 | CWE-184 Incomplete List of Disallowed Inputs | 6.5 Medium |
A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confidentiality or integrity of the system. An attacker can use this vulnerability to construct a request that will cause JavaScript code supplied by the attacker to execute within the user’s browser in the context of that user’s session with the application. Vendor fix: Update to Asset Suite Version 9.6.4.5 when available Mitigation: Apply General Mitigation Factors/Workarounds Affected, fixed & timelineAffected:
Fixed in:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-2500 | 9.1 Critical | Hitachi Energy Asset Suite A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unautho… |
| CVE-2025-1484 | 6.3 Medium | Hitachi Energy Asset Suite A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact t… |
| CVE-2019-9256 | — | n/a Android In libmediaextractor there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional … |
| CVE-2019-9262 | — | n/a Android In MPEG4Extractor, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution in the media extracto… |
| CVE-2019-9290 | — | n/a Android In tzdata there is possible memory corruption due to a mismatch between allocation and deallocation functions. This could lead to local escalation of… |
| CVE-2019-9429 | — | n/a Android In profman, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional exe… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.