[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZWruqzt0Y1M9L7jJYm2UL-HxrgE6ac_HQA7a9CErkxg":3},{"article":4,"iocs":45,"watch_terms":53,"solutions":54,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":32},"0e9c8a42-f317-4c9a-8d48-c254ec5aca56","Hitachi Energy REB500","hitachi-energy-reb500-4f0c5d","View CSAF Summary Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation\u002Fremediation. The following versions of Hitachi Energy REB500 are affected: REB500 vers:REB500\u002F\u003C=8.3.3.1 (CVE-2024-8176, CVE-2025-59375) CVSS Vendor Equipment v3 6.5 Hitachi Energy REB500 2 Vulnerabilities Uncontrolled Recursion, Allocation of Resources Without Limits or Throttling Background Critical Infrastructure Sectors: Energy Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2024-8176 A stack overflow vulnerability exists in the libexpat library used by the IEC61850 functionality supported by REB500 product. An authenticated malicious user with local access could use a crafted IEC 61850 message to exploit the vulnerability in the libexpat library. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage. Read More 1 Affected Product REB500 versions 8.3.3.1 and prior Product Status: known_affected Remediations Vendor fix Update to version 8.3.4.0 Additional Metrics Relevant CWE: CWE-674 Uncontrolled Recursion CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H View CVE Details CVE-2025-59375 libexpat in Expat before 2.7.2 used by the IEC 61850 functionality supported by the REB500 product allows authenticated users to trigger large dynamic memory allocations via a small document that is submitted for parsing. Read More 2 Affected Products REB500 versions 8.3.3.1 and prior Product Status: known_affected Remediations Vendor fix Update to version 8.3.4.0 REB500 versions 8.3.3.1 and prior Product Status: known_affected Remediations Vendor fix Update to version 8.3.4.0 Additional Metrics Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H View CVE Details Acknowledgments Hitachi Energy Internal Team reported these vulnerabilities to CISA. Notice The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners. Support For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https:\u002F\u002Fwww.hitachienergy.com\u002Fcontact-us\u002F for Hitachi Energy contact-centers. General Mitigation Factors Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy’s “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1] SSVC SSVCv2\u002FE:N\u002FA:N\u002F2026-09-28T14:39:04Z\u002F Legal Notice and Terms of Use This product is provided subject to this Notification (https:\u002F\u002Fwww.cisa.gov\u002Fnotification) and this Privacy & Use policy (https:\u002F\u002Fwww.cisa.gov\u002Fprivacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and\u002For systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000247 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-09-29 Date Revision Summary 2026-09-29 1 Initial public release 2026-10-06 2 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000247 advisory Legal Notice and Terms of Use","Hitachi Energy has identified vulnerabilities in its REB500 product, specifically affecting versions 8.3.3.1 and prior. These flaws, stemming from the libexpat library, can be exploited by authenticated users to cause Denial of Service (DoS) attacks. The company recommends updating to version 8.3.4.0 for remediation.","Hitachi Energy REB500 product affected by DoS vulnerabilities in libexpat library.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-279-05",null,"2026-10-06T12:00:00+00:00","2026-10-06T18:00:11.996131+00:00",8,[17,20,23,26],{"name":18,"type":19},"REB500","product",{"name":21,"type":22},"Hitachi Energy","vendor",{"name":24,"type":25},"libexpat","technology",{"name":27,"type":25},"IEC61850","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":12,"name":30,"slug":31},"Vulnerabilities","vulnerabilities",[33,35,40],{"category":34},{"id":28,"icon":12,"name":30,"slug":31},{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50],{"type":47,"value":48,"context":49},"cve","CVE-2024-8176","Stack overflow vulnerability in libexpat library affecting REB500.",{"type":47,"value":51,"context":52},"CVE-2025-59375","Large dynamic memory allocation vulnerability in libexpat library affecting REB500.",[21,18],{"controls":55,"vendors":139},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,97,105],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":86,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":114,"name":115,"problem":116,"products":117},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[118,126,131],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":127,"product_name":128,"url":129,"description":130},"tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":153},"hitachi-energy-reb500-vulnerable-to-dos-via-unpatched-third-party-library","Hitachi Energy REB500 Vulnerable to DoS via Unpatched Third-Party Library","Vulnerabilities in Hitachi Energy's REB500 product (versions 8.3.3.1 and prior) stem from flaws in the bundled libexpat third-party library, highlighting the risk of inherited vulnerabilities from open-source dependencies in critical infrastructure components. Authenticated users can exploit these flaws to trigger Denial of Service conditions, potentially disrupting industrial control and protection systems. This case underscores that even authenticated access can be weaponized when underlying libraries are not kept current. Organizations relying on OT\u002FICS products must actively track third-party component vulnerabilities — not just first-party patches — to maintain a complete security posture.",[145,146,147,148,149,150,151,152],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-82: Guide to ICS Security","NIST SI-2: Flaw Remediation","NIST SA-12: Supply Chain Risk Management","IEC 62443-2-1: Security Management for Industrial Automation","ITIL Change Management: Patch and Update Procedures","CISA ICS Advisory Best Practices",{}]