# Hitachi Energy MSM XSS and assertion flaws remotely exploitable

Published: 2025-10-02 · Severity: routine · Sectors: energy
Canonical: https://vorant.io/reports/fdbd8752-5f92-55ff-a44a-9d37ef27fc44/hitachi-energy-msm-xss-and-assertion-flaws-remotely-exploitable

> Two remotely exploitable flaws in Hitachi Energy MSM allow HTML injection and denial of service; no active exploitation reported.

Hitachi Energy's Modular Switchgear Monitoring (MSM) product versions 2.2.10 and prior contain two remotely exploitable vulnerabilities affecting critical energy infrastructure worldwide. The first, CVE-2023-53155, is an improper input neutralization flaw (CWE-79) in the goform/formTest endpoint of embedded EmbedThis GoAhead 2.5 that allows HTML injection via the name parameter, resulting in cross-site scripting with a CVSS v3.1 score of 7.2. The second, CVE-2024-53429, is a reachable assertion in Open62541 v1.4.6's fuzz_binary_decode function that causes denial of service through application crash, scoring 7.5 on CVSS v3.1.

Neither vulnerability requires authentication or user interaction; both are network-accessible with low attack complexity. CISA notes no known public exploitation to date. Hitachi Energy's primary mitigation is network isolation—MSM is not designed for direct internet exposure and should be disconnected from internet-facing networks. Secondary mitigations include host hardening per CIS benchmarks, browser hardening, restrictive firewall policies, and air-gapping from business networks. Organizations should upgrade to patched versions and implement network segmentation to isolate control systems from external access.

## Mentioned in this report

- Vulnerabilities: CVE-2023-53155, CVE-2024-53429

## Detection guidance (public sample)

### GoAhead formTest Endpoint HTML/Script Injection via name Parameter

ATT&CK: T1190

Web request to the GoAhead /goform/formTest endpoint with HTML or script markers in the name parameter, matching the CVE-2023-53155 reflected XSS pattern in Hitachi Energy MSM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GoAhead formTest Endpoint HTML/Script Injection via name Parameter
description: Detects requests to the GoAhead /goform/formTest endpoint where the name
  parameter carries HTML or script injection markers (plain or URL-encoded). Matches
  the CVE-2023-53155 XSS pattern in Hitachi Energy MSM / EmbedThis GoAhead 2.5. POST
  bodies are not visible in most web logs, so this covers query-string delivery only.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: /goform/formTest
  selection_param:
    cs-uri-query|contains: name=
  selection_xss:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - <img
    - '%3Cimg'
    - <svg
    - '%3Csvg'
    - <iframe
    - '%3Ciframe'
    - onerror=
    - onload=
    - 'javascript:'
  condition: selection_uri and selection_param and selection_xss
falsepositives:
- Authorised web vulnerability scanners run against the MSM device during security
  assessments
- Penetration tests against the OT environment
level: high
id: 330a2d5e-c47a-5677-bd2c-366bc11ec8ea
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-02
```

### Proxy Request with Script Injection to GoAhead formTest Endpoint

ATT&CK: T1190

Proxy-logged request to /goform/formTest with HTML or script payload in the name parameter, indicating attempted exploitation of the MSM GoAhead XSS flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Proxy Request with Script Injection to GoAhead formTest Endpoint
description: Detects proxy-observed requests to /goform/formTest carrying HTML or
  script injection markers in the name parameter, indicating attempted exploitation
  of the GoAhead 2.5 XSS flaw (CVE-2023-53155) in Hitachi Energy MSM.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
detection:
  selection_uri:
    c-uri|contains: /goform/formTest
  selection_param:
    c-uri|contains: name=
  selection_xss:
    c-uri|contains:
    - <script
    - '%3Cscript'
    - <img
    - '%3Cimg'
    - <svg
    - '%3Csvg'
    - <iframe
    - '%3Ciframe'
    - onerror=
    - onload=
    - 'javascript:'
  condition: selection_uri and selection_param and selection_xss
falsepositives:
- Security scanning tools probing embedded web interfaces
- Red team or penetration test activity against OT assets
level: high
id: beaa9c58-9be7-5353-9293-b9f8151ef43e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fdbd8752-5f92-55ff-a44a-9d37ef27fc44/hitachi-energy-msm-xss-and-assertion-flaws-remotely-exploitable.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup