Skip to content
OpenAdvisories
High ICSA-23-005-01 5 CVEs

Hitachi Energy UNEM

Published Jan 5, 2023 · Updated Jan 5, 2023

Vendor: Hitachi Energy Product: UNEM

Summary

Successful exploitation of these vulnerabilities could allow an unauthorized user to obtain sensitive information and gain access to the network elements managed by the UNEM and could cause availability issue on affected UNEM products.

Vulnerabilities 5

  • High 8.3
    CVE-2022-3929

    Communication between the client and server partially using CORBA over TCP/IP

    Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture) over TCP/IP. This protocol is not encrypted and allows tracing of internal messages. This issue affe…

    Hitachi Energy FOXMAN-UN UNEM ICS / OT
  • High 8.0
    CVE-2022-3927

    The affected products store public and private key that are used to sign and protect custom parameter set files from modification.

    The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trus…

    Hitachi Energy FOXMAN-UN UNEM ICS / OT
  • High 7.1
    CVE-2021-40341

    Weak DES encryption

    DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects  * FOXMAN-U…

    Hitachi Energy UNEM FOXMAN-UN ICS / OT
  • High 7.1
    CVE-2021-40342

    Use of default key for encryption

    In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. T…

    Hitachi Energy FOXMAN-UN UNEM ICS / OT
  • High 7.1
    CVE-2022-3928

    Hardcoded credential is found in the message queue

    Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to access data to the internal message queue. This issue affects * FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN…

    Hitachi Energy UNEM FOXMAN-UN ICS / OT

Revision history

  1. #1

    Publication Date

References