Hitachi Energy Asset Suite vulnerable to RCE and DoS
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Six open-source library flaws in Hitachi Energy Asset Suite versions 9.6.4.5 and prior allow remote code execution, denial of service, and information disclosure.
Hitachi Energy Asset Suite versions 9.6.4.5 and prior contain six vulnerabilities in bundled open-source libraries affecting critical infrastructure operations worldwide. The flaws enable remote code execution through Apache ActiveMQ's Jolokia endpoint after authentication, denial-of-service via logback deserialization or Apache CXF resource exhaustion, information disclosure through SSRF in Apache XML Graphics Batik, and cleartext password exposure in H2 Database Engine. The most severe is CVE-2022-41678, allowing post-authentication RCE via reflection-based code execution through JMX handlers; CVE-2023-6378 (logback DoS) and CVE-2025-23184 (CXF resource consumption) both score 8.7 on CVSS v4. No active exploitation has been reported to CISA as of this advisory. Defenders must upgrade to version 9.7 to address five vulnerabilities and version 9.8 (when available) to patch CVE-2022-41678, or apply general mitigations including network isolation and VPN-based access controls.
Mentioned in this report
Detection guidance
ActiveMQ Jolokia Exec Call Against Dangerous JMX MBeans
Web requests to the ActiveMQ Jolokia endpoint that use the exec operation against JMX MBeans abused for post-auth RCE (CVE-2022-41678 pattern). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ActiveMQ Jolokia Exec Call Against Dangerous JMX MBeans
description: Detects HTTP requests to the Jolokia JMX-over-HTTP endpoint (as exposed
by Apache ActiveMQ) that invoke the exec operation on MBeans commonly abused for
reflection or diagnostic-command based code execution (CVE-2022-41678 style). Generalises
on the endpoint plus exec operation plus MBean family, not on a specific host or
credential. Only GET-style requests expose the operation in the URI; POST bodies
need body logging.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: /jolokia/
selection_exec:
cs-uri-stem|contains: /exec/
selection_mbean:
cs-uri-stem|contains:
- jdk.management.jfr
- FlightRecorder
- DiagnosticCommand
- HotSpotDiagnostic
- addNetworkConnector
- createConnector
condition: selection_endpoint and selection_exec and selection_mbean
falsepositives:
- Administrators running JFR or diagnostic commands through Jolokia during troubleshooting
- Authorised vulnerability scanners testing Jolokia endpoints
level: high
id: a57eee30-588a-5c8a-b100-b82c0bfc935a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-04
ActiveMQ Java Process Spawning Shell With Download or Reverse-Shell Commands
A Java process whose parent command line references ActiveMQ spawns a shell running download, reverse-shell or staging commands, which suggests post-exploitation after Jolokia or JMX RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ActiveMQ Java Process Spawning Shell With Download or Reverse-Shell Commands
description: Detects a shell spawned by a Java process whose command line references
ActiveMQ, where the shell runs download, reverse-shell or staging commands. This
is typical post-exploitation after RCE through the Jolokia/JMX interface (CVE-2022-41678).
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /java
ParentCommandLine|contains: activemq
Image|endswith:
- /sh
- /bash
- /dash
CommandLine|contains:
- 'curl '
- 'wget '
- /dev/tcp/
- 'nc '
- base64 -d
- chmod +x
condition: selection
falsepositives:
- ActiveMQ wrapper or startup scripts that download or stage files during upgrades
- Custom broker health-check scripts that call curl from a shell
level: high
id: a0aaec7d-a720-567b-a335-3cfcec7c0482
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-04
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs