# Hitachi Energy Asset Suite vulnerable to RCE and DoS

Published: 2025-09-18 · Severity: high · Sectors: energy, infrastructure
Canonical: https://vorant.io/reports/4eca0460-15f0-53bd-8be3-ff14f29b1698/hitachi-energy-asset-suite-vulnerable-to-rce-and-dos

> Six open-source library flaws in Hitachi Energy Asset Suite versions 9.6.4.5 and prior allow remote code execution, denial of service, and information disclosure.

Hitachi Energy Asset Suite versions 9.6.4.5 and prior contain six vulnerabilities in bundled open-source libraries affecting critical infrastructure operations worldwide. The flaws enable remote code execution through Apache ActiveMQ's Jolokia endpoint after authentication, denial-of-service via logback deserialization or Apache CXF resource exhaustion, information disclosure through SSRF in Apache XML Graphics Batik, and cleartext password exposure in H2 Database Engine. The most severe is CVE-2022-41678, allowing post-authentication RCE via reflection-based code execution through JMX handlers; CVE-2023-6378 (logback DoS) and CVE-2025-23184 (CXF resource consumption) both score 8.7 on CVSS v4. No active exploitation has been reported to CISA as of this advisory. Defenders must upgrade to version 9.7 to address five vulnerabilities and version 9.8 (when available) to patch CVE-2022-41678, or apply general mitigations including network isolation and VPN-based access controls.

## Mentioned in this report

- Vulnerabilities: CVE-2022-41678 (templated), CVE-2022-44729, CVE-2022-45868, CVE-2023-6378, CVE-2024-22262, CVE-2025-23184

## Detection guidance (public sample)

### ActiveMQ Jolokia Exec Call Against Dangerous JMX MBeans

ATT&CK: T1190

Web requests to the ActiveMQ Jolokia endpoint that use the exec operation against JMX MBeans abused for post-auth RCE (CVE-2022-41678 pattern). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ActiveMQ Jolokia Exec Call Against Dangerous JMX MBeans
description: Detects HTTP requests to the Jolokia JMX-over-HTTP endpoint (as exposed
  by Apache ActiveMQ) that invoke the exec operation on MBeans commonly abused for
  reflection or diagnostic-command based code execution (CVE-2022-41678 style). Generalises
  on the endpoint plus exec operation plus MBean family, not on a specific host or
  credential. Only GET-style requests expose the operation in the URI; POST bodies
  need body logging.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: /jolokia/
  selection_exec:
    cs-uri-stem|contains: /exec/
  selection_mbean:
    cs-uri-stem|contains:
    - jdk.management.jfr
    - FlightRecorder
    - DiagnosticCommand
    - HotSpotDiagnostic
    - addNetworkConnector
    - createConnector
  condition: selection_endpoint and selection_exec and selection_mbean
falsepositives:
- Administrators running JFR or diagnostic commands through Jolokia during troubleshooting
- Authorised vulnerability scanners testing Jolokia endpoints
level: high
id: a57eee30-588a-5c8a-b100-b82c0bfc935a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-04
```

### ActiveMQ Java Process Spawning Shell With Download or Reverse-Shell Commands

ATT&CK: T1190

A Java process whose parent command line references ActiveMQ spawns a shell running download, reverse-shell or staging commands, which suggests post-exploitation after Jolokia or JMX RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ActiveMQ Java Process Spawning Shell With Download or Reverse-Shell Commands
description: Detects a shell spawned by a Java process whose command line references
  ActiveMQ, where the shell runs download, reverse-shell or staging commands. This
  is typical post-exploitation after RCE through the Jolokia/JMX interface (CVE-2022-41678).
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /java
    ParentCommandLine|contains: activemq
    Image|endswith:
    - /sh
    - /bash
    - /dash
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - 'nc '
    - base64 -d
    - chmod +x
  condition: selection
falsepositives:
- ActiveMQ wrapper or startup scripts that download or stage files during upgrades
- Custom broker health-check scripts that call curl from a shell
level: high
id: a0aaec7d-a720-567b-a335-3cfcec7c0482
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-04
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4eca0460-15f0-53bd-8be3-ff14f29b1698/hitachi-energy-asset-suite-vulnerable-to-rce-and-dos.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup