Summary
Hitachi Energy is aware of the multiple vulnerabilities that affect the TRMTracker product versions listed in
this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality and integrity impacts.
Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
Vulnerabilities 3
-
Medium 6.5
The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code i…
-
Medium 6.1
A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header valu…
-
Medium 6.1
The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-si…
Revision history
-
#1
Initial version.
References
-
Cybersecurity Advisory - Multiple Vulnerabilities in Hitachi Energy TRMTracker product
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=launch
-
ICS Advisory ICSA-25-093-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B