As reported by CISA in advisory ICSA-26-260-03, Hitachi Energy has disclosed a cluster of five vulnerabilities in its FACTS Control Platform (FCP) that collectively earn a CVSS v3 score of 9.9 — placing them squarely in the critical-severity tier. These flaws affect grid stability equipment deployed globally, and the advisory confirms that any FACTS Control system shipped from 2020 onward with the GWS component is likely affected.
Why This Matters
The affected products — SVC Light (STATCOM), Fixed Series Capacitors, Thyristor Controlled Series Capacitors, Static Var Compensators, Static Watt Compensators, and Hybrid Synchronous Condensers — are the reactive-power devices that keep AC transmission networks from collapsing under load fluctuations. A successful compromise of these systems is not merely a data-loss event; it can manifest as grid instability or equipment damage. The vulnerability classes span injection logic, path traversal, authentication bypass via capture-replay, missing authentication for critical functions, and open redirect — a combination that suggests an attacker could chain access paths from initial entry to persistent control.
Vulnerability Summary
| CVE | Weakness Class | Authentication Required |
|---|---|---|
| CVE-2024-4872 | Improper Neutralization of Special Elements in Data Query Logic (code injection) | Yes |
| CVE-2024-3980 | Path Traversal | See vendor advisory |
| CVE-2024-3982 | Authentication Bypass by Capture-replay | No (bypass) |
| CVE-2024-7940 | Missing Authentication for Critical Function | No |
| CVE-2024-7941 | Open Redirect | See vendor advisory |
Affected Products and Versions
Vendor: Hitachi Energy (Switzerland)
Product: FACTS Control Platform (FCP) — only when GWS component is present
Affected versions: 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0, 4.1.1
Sector: Energy (Critical Infrastructure)
Deployment: Worldwide
Patch/Mitigation: Available via Hitachi Energy remediation guidance referenced in the CISA advisory
Active exploitation observed: Not reported in the advisory
The capture-replay authentication bypass and the missing-authentication flaws are the most dangerous of the set. CVE-2024-4872 requires valid credentials, but the other two can enable unauthenticated access — and the injection flaw then becomes the persistence mechanism.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Inventory validation: Confirm whether the GWS component is present on any FCP deployment. The advisory is clear — no GWS, no exposure.
- Apply vendor remediation: Follow Hitachi Energy's recommended mitigation/remediation steps referenced in the CISA advisory. If a patched firmware or software version is available, prioritize the highest-criticality substations first.
- Network segmentation: Ensure FCP GWS interfaces are isolated from corporate IT and internet-facing zones. Treat the GWS as a Level 3 asset per Purdue Model — no direct inbound from user networks.
- Detect replay attacks: Monitor GWS sessions for anomalous session token reuse, concurrent sessions from unexpected source IPs, and rapid token replays. The capture-replay flaw means session token rotation and TLS termination inspection are critical.
- Block unauthenticated function abuse: For CVE-2024-7940, apply allow-lists at the network layer restricting which hosts can invoke the unauthenticated critical function endpoints on the GWS.
- Hunt for indicators: Review GWS logs for path-traversal patterns (
../, encoded variants), unexpected redirect destinations, and query-string payloads indicative of injection attempts. - Coordinate with vendor: Engage Hitachi Energy support through the channel referenced in the CISA advisory for site-specific remediation timelines, especially for legacy 3.x deployments.
Broader Implications
This disclosure reinforces a pattern Shield53 has tracked across ICS vendors since 2023: authentication design flaws in gateway components (the GWS in this case) are the dominant initial-access vector for OT platforms. Vendors must treat the GWS as a privileged engineering interface — not a convenience portal — and design accordingly. Until that shift happens broadly, operators should assume any web-facing or network-reachable OT gateway component is a candidate for unauthenticated critical access and plan segmentation around that assumption.
