Executive brief
Hitachi Energy FACTS Control Platform (FCP) is a control system used in critical power infrastructure (STATCOM devices, capacitor banks, synchronous condensers) worldwide to manage reactive power and system stability. Multiple vulnerabilities in the GWS component affect confidentiality, integrity, and availability of the platform. An attacker with valid credentials can inject malicious code or traverse the file system to access sensitive files; unauthenticated attackers can access exposed network services or redirect users to phishing sites. These flaws could disrupt power grid operations or compromise critical infrastructure.
Technical details
Five distinct vulnerabilities affect the FACTS Control Platform GWS component. CVE-2024-4872 allows authenticated attackers to inject code into persistent data via improper query validation. CVE-2024-3980 permits authenticated users to traverse the file system and access or modify critical application files due to inadequate pathname validation. CVE-2024-3982 enables local attackers with high privileges to hijack established sessions by exploiting captured session logs (disabled by default). CVE-2024-7940 exposes a local-only service to all network interfaces without authentication, allowing unauthenticated network-based exploitation. CVE-2024-7941 causes open redirects that can be exploited for phishing attacks to steal user credentials. Deployments without the GWS component are unaffected. Mitigation guidance is available in Hitachi Energy security advisory 8DBD000229.
Affected products
- Hitachi Energy FACTS Control Platform (FCP) 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0, 4.1.1
CVE identifiers
- CVE-2024-3982
- CVE-2024-4872
- CVE-2024-7940
- CVE-2024-7941
- CVE-2024-3980
Timeline
- 2026-09-17: disclosed