Summary
Hitachi Energy is aware multiple vulnerabilities that affects the Asset Suite product versions listed below. If these vulnerabilities are successfully exploited by an attacker, it could have an impact on the confidentiality, integrity, or availability of the product.
Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
Vulnerabilities 6
-
High 7.4
A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an…
-
Medium 6.5
A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploite…
-
Unscored —
In libmediaextractor there is a possible out of bounds write due to an integer overflow. This could lead to remote code…
-
Unscored —
In MPEG4Extractor, there is a possible out of bounds write due to an integer overflow. This could lead to remote code e…
-
Unscored —
In tzdata there is possible memory corruption due to a mismatch between allocation and deallocation functions. This cou…
-
Unscored —
In profman, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of pr…
Revision history
-
#1
Initial version.
References
-
CYBERSECURITY ADVISORY - Cross-Site Scripting & Mobile Application Vulnerabilities in Hitachi Energy’s Asset Suite Product
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000195&languageCode=en&Preview=true
-
ICS Advisory ICSA-25-196-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-01
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B