Hitachi Energy Asset Suite
Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality, integrity and availability impact on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-7395US | —OT elevated | — | ||
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity com… | ||||
| CVE-2026-11796US | —OT elevated | — | ||
Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in deni… | ||||
references
External citations — patches, advisories, analysis.
- [1] Hitachi Energy Notification for Industrial Control Systems Cybersecurity Best Practicesself
- Unauthenticated Servlet Access Vulnerabilities in Hitachi Energy Asset Suite Productself
- ICS Advisory ICSA-26-279-03 JSONself
- ICS Advisory ICSA-26-279-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- MitigationAsset Suite
Disable the affected servlet [2] [3] [2] HTTPPublishAdapterTestServlet is meant for testing purposes used in non-production environment [3] Functionality of the servlets, PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet to be evaluated for its utility in the production environment
- MitigationAsset Suite
Disable the affected servlet [2] [3] [2] HTTPPublishAdapterTestServlet is meant for testing purposes used in non-production environment [3] Functionality of the servlets, PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet to be evaluated for its utility in the production environment
- FixedAsset Suite
Update or upgrade to Asset Suite 9.9.1 when available
- FixedAsset Suite
Update or upgrade to Asset Suite 9.9.1 when available
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan