Hitachi Energy FCP flaws affect FACTS Control Platform
Five vulnerabilities in Hitachi Energy's FACTS Control Platform with GWS component allow authenticated attackers to inject data, hijack sessions, bypass auth, or phish credentials.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA republished a Hitachi Energy PSIRT advisory (8DBD000229) covering five vulnerabilities affecting FACTS Control Platform (FCP) systems that include the GWS component, deployed from 2020 onward. Affected product lines include SVC Light (STATCOM), Fixed Series Capacitor, Thyristor Controlled Series Capacitor, Static Var Compensator, Static Watt Compensator, and Hybrid Synchronous Condensers. FCP versions 3.4.0 through 4.1.1 are impacted depending on the specific CVE; deployments without the GWS component are not affected.
The vulnerabilities span multiple weakness classes: CVE-2024-4872 (query injection into persistent data, requires valid credentials), CVE-2024-3980 (path traversal allowing access/modification of critical system files), CVE-2024-3982 (session hijacking via capture-replay when session logging is enabled, requires local access and admin rights to enable), CVE-2024-7940 (a service intended for local-only access is exposed on all network interfaces without authentication), and CVE-2024-7941 (open redirect enabling phishing/credential theft). No CVSS scores were provided in this excerpt and there is no indication of active exploitation in the wild.
Hitachi Energy and CISA recommend general ICS mitigation practices: minimizing network exposure, isolating control system networks behind firewalls, avoiding direct internet connectivity, using VPNs with the latest updates for remote access, enforcing proper password policies, and following the vendor's Industrial Control Systems Cybersecurity Best Practices. Organizations operating affected FACTS Control Platform deployments with GWS should consult the full Hitachi Energy advisory 8DBD000229 for patch/remediation details and prioritize network segmentation given the exposed unauthenticated service (CVE-2024-7940).
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-03
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs