Critical vulnerabilities reported in Hitachi Energy MACH GWS products
Take action: If you're using Hitachi Energy MACH GWS products in your power grid infrastructure, isolate these systems from external networks, implement firewall rules, and ensure only authorized personnel have physical access. Then plan an update to the recommended versions.
Learn More
Hitachi Energy is reporting a critical flaw in disclosed multiple critical security vulnerabilities affecting their MACH GWS products. MACH GWS (Gateway Station) is a product developed by Hitachi Energy that serves as a gateway and communication interface for power grid systems.
These security flaws could allow attackers to inject code, read or modify files, hijack user sessions, or access exposed ports without proper authentication.
Vulnerabilities summary
- CVE-2024-4872 (CVSS score 9.3) Improper Neutralization of Special Elements in Data Query Logic in the query validation of the MACH GWS product. If exploited, this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability, an attacker must have valid credentials.
- CVE-2024-3980 (CVSS score 9.3) Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The MACH GWS product allows authenticated user input to control or influence paths or file names used in filesystem operations. If exploited, the vulnerability allows the attacker to access or modify system files or other files that are critical to the application.
- CVE-2024-7940 (CVSS score 8.8): Missing Authentication for Critical Function. The MACH GWS product exposes a service that is intended for local use only to all network interfaces without any authentication, potentially allowing unauthorized access.
- CVE-2024-3982 (CVSS score 7.3) Authentication Bypass by Capture-replay. An attacker with local access to the machine where MACH GWS is installed could enable session logging supporting the product and attempt to exploit a session hijacking of an already established session. Note that by default, the session logging level is not enabled, and only users with administrator rights can enable it.
The following Hitachi Energy products and versions are affected:
- MACH GWS Version 2.1.0.0: Affected by CVE-2024-4872, CVE-2024-3980
- MACH GWS Versions 2.2.0.0 to 2.4.0.0: Affected by CVE-2024-4872, CVE-2024-3980
- MACH GWS Versions 3.0.0.0 to 3.3.0.0: Affected by CVE-2024-4872, CVE-2024-3980, CVE-2024-3982
- MACH GWS Versions 3.1.0.0 to 3.3.0.0: Affected by CVE-2024-7940
Hitachi Energy recommends that users update to the following versions:
- MACH GWS Versions 3.0.0.0 to 3.3.0.0: Upgrade to version 3.4.0.0
- MACH GWS Version 2.1.0.0: Apply patches HF1 to HF6 sequentially
- MACH GWS Versions 2.2.0.0 to 2.4.0.0: Apply patches HF3 to HF6 sequentially
