Summary
Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker exploiting these vulnerabilities can cause impact on confidentiality, integrity and availability of the product.
Following FACTS Control systems with GWS component deployed from year 2020 onwards are likely affected by the above vulnerabilities. Product deployments without GWS component are not affected.
• SVC Light (STATCOM)
• Fixed Series Capacitor
• Thyristor Controlled Series Capacitor
• Static Var Compensator
• Static Watt Compensator
• Hybrid Synchronous Condensers
Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
The affected FCP versions are only applicable if GWS component is present.
Vulnerabilities 5
-
High 8.8
The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that…
-
High 8.8
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an…
-
High 8.3
The product exposes a service that is intended for local only to all network interfaces without any authentication.
-
High 8.2
An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging suppo…
-
Medium 4.3
An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified …
Revision history
-
#2
Initial CISA Republication of Hitachi Energy PSIRT 8DBD000229 advisory
-
#1
Initial public release
References
-
Multiple Vulnerabilities in Hitachi Energy FACTS Control systems with GWS component
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000229&LanguageCode=en&DocumentPartId=&Action=launch
-
ICS Advisory ICSA-26-260-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-03
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b