Summary
Hitachi Energy is aware of open-source software vulnerabilities that affect MSM product versions listed in this document below. If exploited these vulnerabilities could result in XSS and DoS attacks potentially causing confidentiality, integrity and availability impact to MSM. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
Vulnerabilities 2
-
High 7.5
Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.
-
High 7.2
goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter.
Revision history
-
#4
CISA Republication update based on Hitachi Energy PSIRT 8DBD000228 advisory
-
#3
Updated the remediation recommendation
-
#2
CISA Republication - Initial version.
-
#1
Initial public release.
References
-
[1] Hitachi Energy Notification for Industrial Control Systems Cybersecurity Best Practices
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000235&LanguageCode=en&DocumentPartId=&Action=Launch
-
Open-Source Software Vulnerabilities in Hitachi Energy MSM Product
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000228&LanguageCode=en&DocumentPartId=&Action=launch
-
ICS Advisory ICSA-25-275-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-02
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b