Hitachi Energy MSM XSS and assertion flaws remotely exploitable
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two remotely exploitable flaws in Hitachi Energy MSM allow HTML injection and denial of service; no active exploitation reported.
Hitachi Energy's Modular Switchgear Monitoring (MSM) product versions 2.2.10 and prior contain two remotely exploitable vulnerabilities affecting critical energy infrastructure worldwide. The first, CVE-2023-53155, is an improper input neutralization flaw (CWE-79) in the goform/formTest endpoint of embedded EmbedThis GoAhead 2.5 that allows HTML injection via the name parameter, resulting in cross-site scripting with a CVSS v3.1 score of 7.2. The second, CVE-2024-53429, is a reachable assertion in Open62541 v1.4.6's fuzz_binary_decode function that causes denial of service through application crash, scoring 7.5 on CVSS v3.1.
Neither vulnerability requires authentication or user interaction; both are network-accessible with low attack complexity. CISA notes no known public exploitation to date. Hitachi Energy's primary mitigation is network isolation—MSM is not designed for direct internet exposure and should be disconnected from internet-facing networks. Secondary mitigations include host hardening per CIS benchmarks, browser hardening, restrictive firewall policies, and air-gapping from business networks. Organizations should upgrade to patched versions and implement network segmentation to isolate control systems from external access.
Mentioned in this report
Detection guidance
GoAhead formTest Endpoint HTML/Script Injection via name Parameter
Web request to the GoAhead /goform/formTest endpoint with HTML or script markers in the name parameter, matching the CVE-2023-53155 reflected XSS pattern in Hitachi Energy MSM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GoAhead formTest Endpoint HTML/Script Injection via name Parameter
description: Detects requests to the GoAhead /goform/formTest endpoint where the name
parameter carries HTML or script injection markers (plain or URL-encoded). Matches
the CVE-2023-53155 XSS pattern in Hitachi Energy MSM / EmbedThis GoAhead 2.5. POST
bodies are not visible in most web logs, so this covers query-string delivery only.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|contains: /goform/formTest
selection_param:
cs-uri-query|contains: name=
selection_xss:
cs-uri-query|contains:
- <script
- '%3Cscript'
- <img
- '%3Cimg'
- <svg
- '%3Csvg'
- <iframe
- '%3Ciframe'
- onerror=
- onload=
- 'javascript:'
condition: selection_uri and selection_param and selection_xss
falsepositives:
- Authorised web vulnerability scanners run against the MSM device during security
assessments
- Penetration tests against the OT environment
level: high
id: 330a2d5e-c47a-5677-bd2c-366bc11ec8ea
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-02
Proxy Request with Script Injection to GoAhead formTest Endpoint
Proxy-logged request to /goform/formTest with HTML or script payload in the name parameter, indicating attempted exploitation of the MSM GoAhead XSS flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Proxy Request with Script Injection to GoAhead formTest Endpoint
description: Detects proxy-observed requests to /goform/formTest carrying HTML or
script injection markers in the name parameter, indicating attempted exploitation
of the GoAhead 2.5 XSS flaw (CVE-2023-53155) in Hitachi Energy MSM.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
detection:
selection_uri:
c-uri|contains: /goform/formTest
selection_param:
c-uri|contains: name=
selection_xss:
c-uri|contains:
- <script
- '%3Cscript'
- <img
- '%3Cimg'
- <svg
- '%3Csvg'
- <iframe
- '%3Ciframe'
- onerror=
- onload=
- 'javascript:'
condition: selection_uri and selection_param and selection_xss
falsepositives:
- Security scanning tools probing embedded web interfaces
- Red team or penetration test activity against OT assets
level: high
id: beaa9c58-9be7-5353-9293-b9f8151ef43e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs