Hitachi Energy FACTS Control Platform (FCP)
Hitachi Energy discloses critical vulnerabilities in FACTS Control Platform with GWS component.
Hitachi Energy has announced multiple critical vulnerabilities affecting its FACTS Control Platform (FCP) when the GWS component is present, particularly in deployments from 2020 onwards. These vulnerabilities, including code injection, path traversal, authentication bypass, missing authentication, and open redirect, carry CVSS scores up to 9.9 and could allow authenticated attackers to compromise confidentiality, integrity, and availability. Affected versions range from FCP 3.4.0 to 4.1.1, and mitigation guidance is available in Hitachi Energy's security advisory.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Hitachi Energy?
Get an email when a new story names Hitachi Energy, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMultiple critical vulnerabilities — including authentication bypass, code injection, and path traversal — were discovered in Hitachi Energy's FACTS Control Platform (FCP), affecting versions deployed since 2020. With CVSS scores reaching 9.9, these flaws could allow attackers to fully compromise the confidentiality, integrity, and availability of industrial energy control systems. The presence of the GWS component significantly expands the attack surface, highlighting how optional or integrated components in OT/ICS platforms can introduce severe risk. Unpatched industrial control systems in energy infrastructure are high-value targets, and delayed remediation in these environments can have cascading real-world consequences.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2024-4872
- cve — CVE-2024-3980
- cve — CVE-2024-3982
- cve — CVE-2024-7940
- cve — CVE-2024-7941