CVE-2024-3982: Hitachi Energy FACTS Control Platform multiple vulnerabilities in GWS component

CVE-2024-3982 · Severity: high · CVSS 9.9 · Published 2026-09-17

Hitachi Energy FACTS Control Platform (FCP) is a control system used in critical power infrastructure (STATCOM devices, capacitor banks, synchronous condensers) worldwide to manage reactive power and system stability. Multiple vulnerabilities in the GWS component affect confidentiality, integrity, and availability of the platform. An attacker with valid credentials can inject malicious code or traverse the file system to access sensitive files; unauthenticated attackers can access exposed network services or redirect users to phishing sites. These flaws could disrupt power grid operations or compromise critical infrastructure.

Vendors: Hitachi Energy.

Quick answers

Is CVE-2024-3982 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-3982 being exploited in the wild.
How severe is CVE-2024-3982?
High severity, with a CVSS score of 9.9, published 17 September 2026.
Which products and versions are affected?
Hitachi Energy FACTS Control Platform 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0, 4.1.1.
Is there a fix for CVE-2024-3982?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-3982 attacked?
It is attacked over the network or with local access, in a network appliance.
Am I affected by CVE-2024-3982?
Check whether you run Hitachi Energy FACTS Control Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Five distinct vulnerabilities affect the FACTS Control Platform GWS component. CVE-2024-4872 allows authenticated attackers to inject code into persistent data via improper query validation. CVE-2024-3980 permits authenticated users to traverse the file system and access or modify critical application files due to inadequate pathname validation. CVE-2024-3982 enables local attackers with high privileges to hijack established sessions by exploiting captured session logs (disabled by default). CVE-2024-7940 exposes a local-only service to all network interfaces without authentication, allowing unauthenticated network-based exploitation. CVE-2024-7941 causes open redirects that can be exploited for phishing attacks to steal user credentials. Deployments without the GWS component are unaffected. Mitigation guidance is available in Hitachi Energy security advisory 8DBD000229.

Affected products

  • Hitachi Energy FACTS Control Platform (FCP) 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0, 4.1.1

Identifiers

  • CVE-2024-3982
  • CVE-2024-4872
  • CVE-2024-7940
  • CVE-2024-7941
  • CVE-2024-3980

Timeline

  • 2026-09-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.