Summary
Hitachi Energy is aware of multiple vulnerabilities that affect the SDM600 versions listed below. An attacker who managed to be authenticated to SDM600 and successfully exploit these vulnerabilities could elevate privileges and gain unauthorized access to the system. SDM600 version 1.3.4 is available that remediates the identified vulnerabilities.
Vulnerabilities 2
-
High 8.0
A vulnerability exists in the web-authentication component of the SDM600. If exploited an attacker could escalate privi…
-
High 7.6
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can ta…
Revision history
-
#1.0.0
Initial version.
References
-
CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Hitachi Energy’s SDM600 Series Product
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000191&languageCode=en&Preview=true
-
ICS Advisory ICSA-24-354-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B