CISA ties five 2024 CVEs to Hitachi Energy grid stabilization controllers installed since 2020

An attacker who already holds a valid credential on a FACTS Control system with GWS can inject code toward persistent data through the query validation flaw, classified in the advisory as CWE-943 ^[6]. Under CWE-22, authenticated input can influence the paths and file names used in filesystem operations, which gets the attacker access to or modification of files critical to the application ^[7]. The third described weakness is capture-replay, CWE-294: a user with local access to the machine can switch on the product's session logging and attempt to hijack an established session, and CISA notes that the logging level is disabled by default and that only administrators can enable it ^[8]. A fourth entry concerns a service the product exposes ^[15].

That capture-replay entry is listed against 3.10.0 and later, which is eight of the eleven versions in the advisory; 3.4.0, 3.7.0 and 3.8.0 appear only under the query validation and path traversal entries ^[10].

Whether the GWS component is installed decides the scope. CISA states that deployments without GWS are not affected, and that the affected version list applies only where the component is present ^[4]. The build record for each installation is what tells a control engineer whether a given compensator is in scope. The equipment named is transmission-side: SVC Light (STATCOM), fixed series capacitors, thyristor controlled series capacitors, static var compensators, static watt compensators and hybrid synchronous condensers, deployed from 2020 onward ^[5]. CISA lists the sector as energy and the deployment area as worldwide ^[12].

The five identifiers carry 2024 numbers ^[2]. CISA's advisory number is ICSA-26-260-03, putting about two years between CVE assignment and this notice to asset owners ^[14]. Each described entry carries the same remediation line: follow general mitigation factors, and see Hitachi Energy security advisory 8DBD000229 for more information ^[11]. The CISA text does not name an FCP version that resolves the five CVEs ^[13].

So the near-term work for a transmission operator is an inventory exercise followed by an access review: which FACTS installations run GWS, and which accounts and which workstations can reach them. Every path CISA describes in detail starts with a credential or with local access to the machine where FCP is installed ^[6][8]. CISA's summary says an attacker exploiting the vulnerabilities can affect the confidentiality, integrity and availability of the product ^[17].