> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Hitachi Energy FACTS Control Platform (FCP) - URL: https://f4n6.co.uk/security-feed/hitachi-energy-facts-control-platform-fcp/ - Published: 2026-09-17T21:41:57.000Z - Updated: 2026-09-17T21:41:57.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary CISA has republished Hitachi Energy PSIRT advisory 8DBD000229 covering five vulnerabilities in the FACTS Control Platform (FCP) with the GWS component, affecting versions 3.4.0 through 4.1.1 (CVE-2024-4872, CVE-2024-3980, CVE-2024-3982, CVE-2024-7940, CVE-2024-7941). The two most severe flaws, CVE-2024-4872 (CWE-943, CVSS v3.1 9.9 CRITICAL) and CVE-2024-3980 (CWE-22, CVSS v3.1 9.9 CRITICAL), allow an authenticated attacker to inject code into persistent data and to read or modify arbitrary system files via path traversal; both require valid credentials but are network-exploitable with low complexity. Deployments without the GWS component are not affected. No CISA-KEV exploitation state is recorded for any of these CVEs in the verified reference data for this item, and no exploitation in the wild is reported in the source. Direct impact on EMEA financial services is limited: FCP runs in energy transmission infrastructure, not banking IT, but financial institutions with grid-connected facilities, data-centre power contracts, or exposure to energy-sector counterparties should treat this as a third-party/sectoral risk item rather than an internal patching priority. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The advisory concerns a vendor disclosure in energy-sector OT with no reported exploitation, no incident at a financial entity, and no named ICT third-party relationship to a financial firm. If a client confirms it operates affected FCP deployments (for example through a captive energy infrastructure subsidiary), DORA Art. 24 (digital operational resilience testing, general requirements) would become relevant to the compensating-control validation described in §4, but that trigger is not established by the source material. ## 3\. Technical analysis & attack chain Affected product and scope. The vulnerabilities affect Hitachi Energy FACTS Control Platform (FCP) installations that include the GWS component, in versions 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1\. The affected deployments are FACTS control systems shipped from 2020 onwards: SVC Light (STATCOM), Fixed Series Capacitor, Thyristor Controlled Series Capacitor, Static Var Compensator, Static Watt Compensator and Hybrid Synchronous Condensers. Installations without GWS are not affected. CISA lists the critical infrastructure sector as Energy, deployed worldwide, vendor headquartered in Switzerland. The five vulnerabilities, with the CVSS values as published in the advisory: | CVE | CWE | CVSS v3.1 | Severity | Vector | | ------------- | ------------------------------------------------------------------------ | --------- | -------- | ----------------------------------- | | CVE-2024-4872 | CWE-943, improper neutralization of special elements in data query logic | 9.9 | CRITICAL | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | | CVE-2024-3980 | CWE-22, path traversal | 9.9 | CRITICAL | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | | CVE-2024-3982 | CWE-294, authentication bypass by capture-replay | 8.2 | HIGH | AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | | CVE-2024-7940 | CWE-306, missing authentication for critical function | 8.3 | HIGH | AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H | | CVE-2024-7941 | CWE-601, open redirect | 4.3 | MEDIUM | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | Attack chain, as far as the source supports it. The advisory describes vulnerability mechanisms, not an observed intrusion, so the chain below is the exploitation path the flaws permit, not a confirmed campaign. 1. Initial access. An attacker with valid FCP credentials reaches the GWS web application over the network (CVE-2024-4872, CVE-2024-3980 both carry AV:N/PR:L). Separately, an unauthenticated remote attacker can reach a service that the product intends for local use only but exposes on all network interfaces without authentication (CVE-2024-7940), and can abuse an HTTP parameter that accepts a URL value to redirect requests to an attacker-controlled site (CVE-2024-7941). 2. Code injection into persistent data. Via the query-validation flaw (CVE-2024-4872), the authenticated attacker injects code toward persistent data. The advisory does not specify the query language, the storage backend, or the execution context, so the exact post-injection impact cannot be stated from this source. 3. Filesystem access. Via the path traversal flaw (CVE-2024-3980), authenticated user input controls paths or file names used in filesystem operations, letting the attacker access or modify system files or other files critical to the application. The advisory does not name specific files, directories or the traversal syntax. 4. Session hijacking (local prerequisite). With local access to the FCP machine, an attacker can enable session logging and attempt to hijack an already-established session (CVE-2024-3982). By default session logging is disabled and only administrator-level users can enable it, which constrains this path to an attacker who already holds local administrative access. 5. Impact. The vendor states exploitation affects confidentiality, integrity and availability of the product. No malware, persistence mechanism, command-and-control infrastructure, lateral movement or data exfiltration is described, and none should be assumed. Caveats. The source is a single vendor advisory (Hitachi Energy PSIRT 8DBD000229), republished verbatim by CISA with an explicit disclaimer that CISA is not responsible for its technical accuracy. No CVE in this set has a CISA-KEV exploitation state in the verified reference data for this item, and no due date or known-exploited designation exists. The advisory's SSVC decision point is E:N/A:N (no known exploitation, no active automation), dated 2026-07-24\. Technical detail on exploitation mechanics is thin: no proof-of-concept, port, protocol or file-path specifics are given. The vendor's remediation guidance is limited to "follow general mitigation factors" and a pointer to advisory 8DBD000229; no patched version is named in the source material, and none should be inferred. ## 4\. Mitigation & containment The source names no patched FCP version and no vendor fix beyond "general mitigation factors" and the pointer to Hitachi Energy advisory 8DBD000229\. The steps below combine the vendor's and CISA's stated defensive measures with the access constraints visible in the CVSS vectors. ### P1, within 24 hours - Inventory and scope. Identify any FCP deployments in the estate, confirm whether the GWS component is present, and record the version. Deployments without GWS are not affected and can be deprioritised. Affected versions are 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0, 4.1.1. - Contact Hitachi Energy PSIRT or the product provider directly for the remediation path under advisory 8DBD000229\. The CISA republication explicitly directs technical questions to the vendor PSIRT; do not treat the CISA page as the fix authority. - Network containment for CVE-2024-7940\. Identify the service the product exposes on all network interfaces that is intended for local use only, and restrict it at the firewall to the loopback interface or an isolated management segment. CISA's stated practice is a firewall with a minimal number of exposed ports separating the process control network from other networks. - Credential hygiene. CVE-2024-4872 and CVE-2024-3980 both require valid credentials (PR:L). Rotate FCP credentials, enforce the vendor's proper password policy, and review account validity on any GWS-enabled system. ### P2, within 72 hours - Verify that no FCP system has a direct Internet connection, per the vendor's stated practice. If any does, remove the connection and treat the host as potentially compromised pending review. - Confirm session logging is disabled on all FCP with GWS (the default state), since CVE-2024-3982 requires it enabled. Restrict the ability to enable it to administrator accounts, and alert on any change to the session logging level. - Restrict local access to FCP hosts to authorised personnel only, per the vendor's physical-protection guidance, since CVE-2024-3982 requires local access with high privileges. - Block or validate outbound redirects from the GWS web application where a proxy or egress filter sits in front of it, to blunt CVE-2024-7941 phishing redirects. ### P3, within 7 days - Apply the vendor's general ICS practices to the process control network: no Internet surfing, instant messaging or email on control systems; virus scanning of portable computers and removable media before connection; defence-in-depth layering per CISA's ICS guidance. - Track the vendor advisory 8DBD000229 for a patched release and schedule the upgrade for all GWS-enabled systems in the affected version range. No fixed version is identified in the current source. - Report any suspected malicious activity on these systems to CISA for tracking and correlation, per the advisory's closing instruction, and follow established internal incident procedures. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The advisory is a vulnerability disclosure with no reported exploitation, no malware description and no atomic indicators. No behavioural indicators are described either: the source gives no authentication patterns, process activity or network signatures tied to exploitation of these CVEs. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no strings, file names, registry keys, command-line flags, mutexes or network signatures belonging to the threat. The only artefacts present are CVE identifiers, product names and CWE labels, which detect reporting about the vulnerability rather than exploitation of it, and a YARA or Sigma rule built from them would be invalid. ## 7\. Sources - CISA, Hitachi Energy FACTS Control Platform (FCP), ICSA-26-260-03, https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-03, published 2026-09-17 (revision 2, initial CISA republication of Hitachi Energy PSIRT 8DBD000229; vendor initial public release 2026-07-28) - Hitachi Energy PSIRT, advisory 8DBD000229, referenced by the CISA publication as the authoritative remediation source; no direct URL to the vendor advisory is provided in the source material ## 8\. Adverse Trace position We assess this as a credible but unexploited disclosure: two CRITICAL (9.9) and two HIGH flaws in an energy-sector control platform, all requiring either valid credentials, local access or user interaction, with no KEV listing, no known exploitation and no patched version named in the source. For EMEA financial services clients the direct attack surface is near zero unless the client operates affected FCP hardware, which we expect to be rare; the material exposure is sectoral, through the stability of energy suppliers and grid operators that use FACTS equipment, and contractual, where a client's operational-resilience assessments cover energy-dependent critical operations. The single-source basis of all technical detail (one vendor advisory, republished by CISA without independent verification) is a confidence limitation, and the absence of a named fixed version means compensating controls, not patching, are the near-term defence. We will track Hitachi Energy advisory 8DBD000229 for a remediation release, monitor CISA-KEV for any exploitation designation against these five CVEs, and update this advisory if either changes. --- [Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-03?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*