Multiple vulnerabilities reported in Hitachi Energy Asset Suite, at least one critical
Take action: If you're using Hitachi Energy Asset Suite, make sure the systems are isolated from the internet and used only for the dedicated purpose (no web browsing, email, or instant messaging.). Then contact the vendor for patches.
Learn More
Hitachi Energy is reporting multiple vulnerabilities in its Asset Suite platform, including one critical severity flaw. The flaws could enable attackers to perform remote code execution, escalate privileges, steal sensitive data, or completely compromise critical energy infrastructure systems.
Vulnerability summary:
- CVE-2025-2500 (CVSS score 9.1) - Plaintext Storage of Password. A critical vulnerability in SOAP web services that stores passwords in plaintext, enabling unauthorized access and expanding attack windows.
- CVE-2019-9262 (CVSS score 8.8) - Out-of-bounds Write. A vulnerability in the MPEG4Extractor component that could trigger memory corruption, potentially leading to remote code execution.
- CVE-2019-9429 (CVSS score 7.8) - Out-of-bounds Write. A memory corruption vulnerability in the profman component that could result in local privilege escalation.
- CVE-2019-9256 (CVSS score 7.8) - Out-of-bounds Write. An integer overflow vulnerability in the libmediaextractor component that could enable remote code execution.
- CVE-2019-9290 (CVSS score 7.8) - Release of Invalid Pointer or Reference: A vulnerability in the tzdata component caused by allocation-deallocation function mismatches, potentially leading to local privilege escalation.
- CVE-2025-1484 (CVSS score 6.3) - Incomplete List of Disallowed Inputs. A cross-site scripting vulnerability in the media upload component that allows attackers to execute malicious JavaScript code within user browser sessions.
The security vulnerabilities impact the following Hitachi Energy products:
Asset Suite 9 Series:
- Version 9.6.4.4 (affected by CVE-2025-1484, CVE-2025-2500)
- Version 9.7 (affected by CVE-2025-2500)
Asset Suite AnyWhere for Inventory (AWI) Android Mobile App:
- Versions 11.5 and prior (affected by CVE-2019-9262, CVE-2019-9429, CVE-2019-9256, CVE-2019-9290)
Hitachi Energy has provided the following mitigation guidance:
- For CVE-2025-1484 affecting Asset Suite version 9.6.4.4, the company recommends updating to version 9.6.4.5 when available
- CVE-2025-2500 affecting both Asset Suite versions 9.6.4.4 and 9.7, only general mitigation factors are currently available, no patch has been released yet.
Organizations are strongly advised to avoid using process control systems for web browsing, instant messaging, or email communications. All portable computers and removable storage media should undergo thorough virus scanning before connecting to control systems. Additionally, proper password policies and processes should be enforced across all systems.
