As reported by CISA in ICS Advisory ICSA-26-188-02, a significant transport-layer security deficiency has been disclosed in Hitachi Energy's PROMOD V software — a platform used in energy sector operations worldwide. At Shield53, we want to be direct: an energy management tool transmitting data in cleartext HTTP in 2026 is not a minor oversight. It represents a systemic risk to operational technology (OT) environments where the consequences of credential compromise extend well beyond data loss.

Security Impact: As reported by CISA in ICS Advisory ICSA-26-188-02, a significant transport-layer security deficiency has been disclosed in Hitachi Energy's PROMOD V software — a platform used in energy sector operations worldwide.

Vulnerability At a Glance

CVE ID
CVE-2026-10763
CVSS v3 Score
7.1 — High
Affected Vendor
Hitachi Energy (Headquarters: Switzerland)
Affected Product
PROMOD V, all versions 1.0.10 and prior
Vulnerability Type
Reliance on HTTP instead of HTTPS (CWE-319: Cleartext Transmission of Sensitive Information)
Root Cause
Lack of HTTPS support in the third-party Digipede server component
Patch Available
Not confirmed at time of advisory — contact Hitachi Energy for remediation guidance
Active Exploitation Observed
Not reported at this time
Deployment Scope
Worldwide — Critical Infrastructure (Energy Sector)

Why This Matters More Than It Might Appear

The CVSS score of 7.1 may lead some administrators to deprioritize this finding behind more flashy remote code execution vulnerabilities. That would be a mistake. In energy sector OT and IT-OT convergence environments, credential theft and session hijacking carry outsized consequences. An adversary who intercepts a PROMOD V session on a poorly segmented network doesn't just gain access to software — they may gain visibility into power generation schedules, load forecasting data, or operational parameters that could inform a broader physical or cyber attack against grid infrastructure.

The root cause deserves particular attention: the vulnerability is attributed to a third-party component — the Digipede server — that does not support HTTPS. This is a recurring and dangerous pattern in industrial software. Vendors integrate legacy or niche third-party frameworks and inherit their security debt. End users often have no visibility into these dependencies, and patching is controlled by the primary vendor's timeline, not the organization's own security posture. This is exactly the kind of supply chain blind spot that threat actors — especially nation-state groups targeting energy infrastructure — have learned to exploit.

Who Is Most At Risk

Why This Matters More Than It Might Appear
Energy utilities and grid operators running PROMOD V in environments where network traffic traverses shared or semi-trusted segments
Organizations with flat or poorly segmented OT/IT networks where an attacker with initial access to a corporate network could pivot to observe PROMOD V traffic
Deployments accessed over VPNs or remote access solutions that terminate before reaching the PROMOD V server, leaving internal traffic still exposed
Sites in geopolitically sensitive regions where energy infrastructure is an active targeting priority for state-sponsored threat actors

The Third-Party Component Problem

The Digipede dependency is a microcosm of a broader industrial software challenge. Many SCADA, EMS, and OT platforms were built in eras when internal network trust was assumed and encryption was considered optional overhead. As these systems age and accumulate third-party integrations, their attack surfaces grow in ways that are invisible to the end operator. Organizations cannot patch what they cannot see. This advisory is a reminder that software bill of materials (SBOM) practices aren't just a compliance checkbox — they are a prerequisite for understanding your actual exposure.

"An unencrypted session in an energy management platform isn't just a confidentiality risk — it's a potential reconnaissance channel for adversaries mapping operational infrastructure."

Shield53 Recommendations — Immediate Actions

1. Network-Level Compensating Controls (Apply Now)

  • Isolate PROMOD V servers on dedicated VLANs with strict ACLs — limit traffic to authorized clients only
  • Deploy network-based IDS/IPS rules to alert on cleartext credential patterns or anomalous HTTP sessions involving PROMOD V hosts
  • Implement encrypted tunneling (IPSec or application-layer TLS proxy) between PROMOD V clients and servers where feasible as an interim measure

2. Detection and Monitoring

  • Enable full packet capture or NetFlow logging on segments hosting PROMOD V and baseline normal communication patterns
  • Alert on any HTTP traffic from PROMOD V hosts traversing beyond expected network boundaries
  • Monitor for credential reuse anomalies — if session tokens are stolen, you may see authentication from unexpected sources

3. Vendor Engagement

  • Contact Hitachi Energy directly to obtain the current patch roadmap and any available hotfixes or configuration guidance
  • Request SBOM documentation to identify other third-party components in your PROMOD V deployment
  • Subscribe to Hitachi Energy's security advisories for update notifications

4. Strategic Actions

  • Conduct a broader audit of all OT/ICS software in your environment for cleartext protocol usage (HTTP, FTP, Telnet, SNMP v1/v2)
  • Incorporate HTTPS and transport encryption requirements into vendor procurement criteria going forward
  • Review incident response playbooks to include scenarios involving OT credential compromise

Shield53 will continue monitoring for any indication of active exploitation of CVE-2026-10763. Energy sector defenders should treat this as a high-priority item for the current patching cycle, regardless of the absence of confirmed in-the-wild exploitation — the threat model for grid infrastructure demands a proactive, not reactive, posture.