CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-25-016-06: Hitachi Energy FOX61x, FOXCST, and FOXMAN-UN Products ↗ source

January 16, 2025 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-25-016-06

Summary

Hitachi Energy is aware of a vulnerability that affects the FOXMAN-UN/FOXCST versions listed below. If exploited an attacker could potentially intercept or falsify data exchanges between the client and the server. Please refer to the “Recommended Immediate Actions” for information about the remediation. CVE-2024-2462: Hitachi Energy is aware of a vulnerability that affects the FOXCST client application which if exploited would allow attackers to intercept or falsify data exchanges between the client and the server.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-25-016-06
Status
Final · version 1.0.0
Initial release
2024-06-11
Last revised
2024-06-11
Vendor
Hitachi Energy
Critical infrastructure sectors
Critical Manufacturing
Deployed
Worldwide
Vendor headquarters
Switzerland

Republished vendor advisory. This CISA CSAF advisory was converted from Hitachi Energy PSIRT's CSAF advisory.

General Mitigation Factors/Workarounds: Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

Credit: Darius Pavelescu, Bernhard Rader (Limes Security)

Affected products (3)
  • FOX61x — <R16B, R16B
  • FOXCST — <16.2.1, 16.2.1
  • FOXMAN-UN — R15A, <=R15B_PC4, R15B_PC5, R16A, R16B, <=R16B_PC2, >=R16B_PC3, <R15A

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2024-2462 CWE-297 Improper Validation of Certificate with Host Mismatch 4.9 Medium Hitachi Energy is aware of a vulnerability that affects the FOXCST client application which if exploited would allow attackers to intercept or falsify data exchanges between the client and the server.

Vendor fix: Update to FOXMAN-UN R16B PC3 or later and apply general mitigation factors.

Vendor fix: Update to FOXMAN-UN R15B PC5 and apply general mitigation factors. (Update planned)

No fix planned: EOL versions - no remediation will be available. Recommended to update to FOXMAN-UN R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.

Affected, fixed & timeline

Affected:

  • FOXMAN-UN <=R16B_PC2
  • FOXMAN-UN <=R15B_PC4
  • FOXMAN-UN R16A
  • FOXMAN-UN R15A
  • FOX61x <R16B
  • FOXCST <16.2.1
  • FOXMAN-UN <R15A

Fixed in:

  • FOXMAN-UN >=R16B_PC3
  • FOXMAN-UN R15B_PC5
  • FOX61x R16B
  • FOXCST 16.2.1

Vendor fix: Update to FOX61x R16B

Vendor fix: Update to FOXCST_16.2.1

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2024-2462 6.8 Medium Hitachi Energy FOXMAN-UN Allow attackers to intercept or falsify data exchanges between the client and the server

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.