Summary
Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality, integrity and availability impact on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
Vulnerabilities 2
-
High 8.5
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration fil…
-
Medium 5.1
Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServle…
Revision history
-
#2
Initial CISA Republication of Hitachi Energy PSIRT 8DBD000254 advisory
-
#1
Initial public release
References
-
[1] Hitachi Energy Notification for Industrial Control Systems Cybersecurity Best Practices
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000235&LanguageCode=en&DocumentPartId=&Action=Launch
-
Unauthenticated Servlet Access Vulnerabilities in Hitachi Energy Asset Suite Product
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000254&LanguageCode=en&DocumentPartId=&Action=launch
-
ICS Advisory ICSA-26-279-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-03
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b