ICSA-25-014-01

Hitachi Energy FOXMAN-UN

view advisory published 2024-06-11

Hitachi Energy is aware of multiple internal reported vulnerabilities that affects the FOXMAN-UN versions listed below. Please refer to the “Recommended Immediate Actions” for information about the remediation.

describes (8)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-28024US	medium4.1OT elevated	0.11% (1st)	—	2024-06-11
A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another control sphere.
CVE-2024-28022US	medium6.5	0.36% (29th)	—	2024-06-11
A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords…
CVE-2024-28020US	high8.0	0.37% (30th)	—	2024-06-11
A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login…
CVE-2024-2013US	critical10.0OT elevated	0.68% (52nd)	—	2024-06-11
An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the servi…
CVE-2024-2012US	critical9.8OT elevated	0.60% (49th)	—	2024-06-11
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allo…
CVE-2024-2011US	critical9.8	0.47% (40th)	—	2024-06-11
A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code, whi…
CVE-2024-28023US	—OT elevated	0.17% (6th)	—	2024-06-11
A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintended actors, possibly providing attacke…
CVE-2024-28021US	high7.4	0.27% (19th)	—	2024-06-11
A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an attacker could spoof a trusted entity cau…

references

External citations — patches, advisories, analysis.

CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Hitachi Energy’s FOXMAN-UNself
ICS Advisory ICSA-25-014-01 JSONself
Recommended Practicesexternal
ICS Advisory ICSA-25-014-01 - Web Versionself
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal

remediations (40)

MitigationFOXMAN-UN R15B
Apply general mitigation factors
MitigationFOXMAN-UN R15B
Apply general mitigation factors
MitigationFOXMAN-UN R15B
Deny nemadm account for ssh logins by configuring DenyUsers in /etc/ssh/sshd_config
https://www.redhat.com/sysadmin/eight-ways-secure-ssh
MitigationFOXMAN-UN R16B
Apply general mitigation factors
MitigationFOXMAN-UN R16B
Apply general mitigation factors
MitigationFOXMAN-UN R16B
Deny nemadm account for ssh logins by configuring DenyUsers in /etc/ssh/sshd_config
https://www.redhat.com/sysadmin/eight-ways-secure-ssh
No fix plannedFOXMAN-UN R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R16A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R16A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R16A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R16A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R16A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R16A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R16A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN R16A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN older than R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN older than R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN older than R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN older than R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN older than R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN older than R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN older than R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
No fix plannedFOXMAN-UN older than R15A
EOL versions - no remediation will be available. Recommended to update to UNEM R16B PC4 or R15B PC5 (update planned) and apply general mitigation factors.
FixedFOXMAN-UN R15B PC4
Update to FOXMAN-UN R15B PC5 (under development) and apply general mitigation factors.
FixedFOXMAN-UN R15B PC4
Update to FOXMAN-UN R15B PC5 (under development) and apply general mitigation factors.
FixedFOXMAN-UN R15B PC4
Update to FOXMAN-UN R15B PC5 (under development) and apply general mitigation factors.
FixedFOXMAN-UN R15B PC4
Update to FOXMAN-UN R15B PC5 (under development) and apply general mitigation factors.
FixedFOXMAN-UN R15B PC4
Update to FOXMAN-UN R15B PC5 (under development) and apply general mitigation factors.
FixedFOXMAN-UN R16B PC2
Fixed in FOXMAN-UN R16B PC3 Recommended to update to FOXMAN-UN R16B PC4 and apply general mitigation factors.
FixedFOXMAN-UN R16B PC2
Fixed in FOXMAN-UN R16B PC3 Recommended to update to FOXMAN-UN R16B PC4 and apply general mitigation factors.
FixedFOXMAN-UN R16B PC2
Fixed in FOXMAN-UN R16B PC3 Recommended to update to FOXMAN-UN R16B PC4 and apply general mitigation factors.
FixedFOXMAN-UN R16B PC2
Fixed in FOXMAN-UN R16B PC3 Recommended to update to FOXMAN-UN R16B PC4 and apply general mitigation factors.
FixedFOXMAN-UN R16B PC2
Fixed in FOXMAN-UN R16B PC3 Recommended to update to FOXMAN-UN R16B PC4 and apply general mitigation factors.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan