ICSA-25-063-05: Hitachi Energy UNEM/ECST

Summary

Hitachi Energy is aware of a vulnerability that affects the UNEM/ECST versions listed below. If exploited an attacker could potentially intercept or falsify data exchanges between the client and the server. Please refer to the “Recommended Immediate Actions” for information about the remediation. CVE-2024-2462: Hitachi Energy is aware of a vulnerability that affects the ECST client application which if exploited would allow attackers to intercept or falsify data exchanges between the client and the server.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-25-063-05
Status: Final · version 1.0.0
Initial release: 2024-06-11
Last revised: 2024-06-11
Vendor: Hitachi Energy
Critical infrastructure sectors: Energy
Deployed: Worldwide
Vendor headquarters: Switzerland

Republished vendor advisory. This CISA CSAF advisory was converted from Hitachi Energy PSIRT's CSAF advisory.

General Mitigation Factors/Workarounds: Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

Credit: Hitachi Energy PSIRT; Darius Pavelescu, Bernhard Rader (Limes Security)

Affected products (3)

XMC20 — <R16B, R16B
ECST — <16.2.1, 16.2.1
UNEM — R15A, <=R15B_PC4, R15B_PC5, R16A, R16B, <=R16B_PC2, >=R16B_PC3, <R15A

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2024-2462	CWE-297 Improper Validation of Certificate with Host Mismatch	4.9 Medium	Hitachi Energy is aware of a vulnerability that affects the ECST client application which if exploited would allow attackers to intercept or falsify data exchanges between the client and the server. Vendor fix: Update to UNEM R16B PC3 or later and apply general mitigation factors. Vendor fix: Update to UNEM R15B PC5 and apply general mitigation factors. (Update planned) No fix planned: EOL versions - no fix will be available. Apply general mitigation factors. It should be noted that customers with a UNEM R16A installation are entitled to an update to the UNEM R16B given the R16B is not in an inactive lifecycle state. Affected, fixed & timeline Affected: UNEM <=R16B_PC2 UNEM <=R15B_PC4 UNEM R16A UNEM R15A XMC20 <R16B ECST <16.2.1 UNEM <R15A Fixed in: UNEM >=R16B_PC3 UNEM R15B_PC5 XMC20 R16B ECST 16.2.1 Vendor fix: Update to XMC20 R16B Vendor fix: Update to ECST_16.2.1

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-2462	6.8 Medium	Hitachi Energy FOXMAN-UN Allow attackers to intercept or falsify data exchanges between the client and the server

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.

CyberzSOC