www.cisa.gov
Open in
urlscan Pro
2600:1417:3f:781::447a
Public Scan
URL:
https://www.cisa.gov/news-events/ics-advisories/icsa-24-317-02
Submission: On November 12 via manual from SG — Scanned from SG
Submission: On November 12 via manual from SG — Scanned from SG
Form analysis 2 forms found in the DOM
<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id1">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form><form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id2">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form>Text Content
Skip to main content
An official website of the United States government
Here’s how you know
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United
States.
Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.
Free Cyber ServicesElection Threat Updates#protect2024Secure Our WorldShields
UpReport A Cyber Issue
Search
×
search
Menu
Close
×
search
* Topics
Topics
Cybersecurity Best Practices
Cyber Threats and Advisories
Critical Infrastructure Security and Resilience
Election Security
Emergency Communications
Industrial Control Systems
Information and Communications Technology Supply Chain Security
Partnerships and Collaboration
Physical Security
Risk Management
How can we help?
GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
LocallyFaith-Based CommunityExecutivesHigh-Risk Communities
* Spotlight
* Resources & Tools
Resources & Tools
All Resources & Tools
Services
Programs
Resources
Training
Groups
* News & Events
News & Events
News
Events
Cybersecurity Alerts & Advisories
Directives
Request a CISA Speaker
Congressional Testimony
CISA Conferences
CISA Live!
* Careers
Careers
Benefits & Perks
HireVue Applicant Reasonable Accommodations Process
Hiring
Resume & Application Tips
Students & Recent Graduates
Veteran and Military Spouses
Work @ CISA
* About
About
Culture
Divisions & Offices
Regions
Leadership
Doing Business with CISA
Site Links
Reporting Employee and Contractor Misconduct
CISA GitHub
CISA Central
2023 Year In Review
Contact Us
Subscribe
Free Cyber ServicesElection Threat Updates#protect2024Secure Our WorldShields
UpReport A Cyber Issue
Breadcrumb
1. Home
2. News & Events
3. Cybersecurity Advisories
4. ICS Advisory
Share:
ICS Advisory
HITACHI ENERGY TRO600
Release Date
November 12, 2024
Alert Code
ICSA-24-317-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF(link is external)
1. EXECUTIVE SUMMARY
* CVSS v3 7.2
* ATTENTION: Exploitable remotely/low attack complexity
* Vendor: Hitachi Energy
* Equipment: TRO600 Series
* Vulnerabilities: Command Injection, Improper Removal of Sensitive Information
Before Storage or Transfer
2. RISK EVALUATION
Command injection vulnerability in the Edge Computing UI for the TRO600 series
radios that allows for the execution of arbitrary system commands. If exploited,
an attacker with write access to the web UI can execute commands on the device
with root privileges, far more extensively than the write privilege intends.
Profile files from TRO600 series radios are extracted in plain-text and
encrypted file formats. Profile files provide potential attackers valuable
configuration information about the Tropos network. Profiles can only be
exported by authenticated users with write access.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following products of Hitachi Energy are affected:
* Hitachi Energy TRO600 series firmware versions: 9.0.1.0 - 9.2.0.0
(CVE-2024-41156)
* Hitachi Energy TRO600 series firmware versions: 9.1.0.0 - 9.2.0.0
(CVE-2024-41153)
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND ('COMMAND
INJECTION') CWE-77(LINK IS EXTERNAL)
Command injection vulnerability in the Edge Computing UI for the TRO600 series
radios that allows for the execution of arbitrary system commands. If exploited,
an attacker with write access to the web UI can execute commands on the device
with root privileges, far more extensive than what the write privilege intends.
CVE-2024-41153(link is external) has been assigned to this vulnerability. A CVSS
v3 base score of 7.2 has been assigned; the CVSS vector string is
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H(link is external)).
3.2.2 IMPROPER REMOVAL OF SENSITIVE INFORMATION BEFORE STORAGE OR TRANSFER
CWE-212(LINK IS EXTERNAL)
Profile files from TRO600 series radios are extracted in plain-text and
encrypted file formats. Profile files provide potential attackers valuable
configuration information about the Tropos network. Profiles can only be
exported by authenticated users with write access.
CVE-2024-41156(link is external) has been assigned to this vulnerability. A CVSS
v3 base score of 2.7 has been assigned; the CVSS vector string is
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N(link is external)).
3.3 BACKGROUND
* CRITICAL INFRASTRUCTURE SECTORS: Energy
* COUNTRIES/AREAS DEPLOYED: Worldwide
* COMPANY HEADQUARTERS LOCATION: Switzerland
3.4 RESEARCHER
Riley Barello-Myers, Idaho National Lab - CyTRICS reported these vulnerabilities
to Hitachi Energy.
4. MITIGATIONS
Hitachi Energy has identified the following specific workarounds and mitigations
users can apply to reduce risk:
* (CVE-2024-41153) Hitachi Energy TRO600 series firmware versions from 9.1.0.0
to 9.2.0.0 (Edge computing functionality): Update to version 9.2.0.5
* (CVE-2024-41156) Hitachi Energy TRO600 series firmware versions from 9.0.1.0
to 9.2.0.0 (Configuration utility): Update to version 9.2.0.5
Hitachi Energy has provided the additional following security practices and
firewall configurations can help protect a process control network from attacks
that originate from outside the network:
* Physically protect process control systems from direct access by unauthorized
personnel.
* Do not connect directly to the Internet.
* Separate from other networks by means of a firewall system that has a minimal
number of ports exposed.
* Process control systems should not be used for Internet surfing, instant
messaging, or receiving e-mails.
* Portable computers and removable storage media should be carefully scanned
for viruses before they are connected to a control system.
For more details, refer to the "Configuration Guide" document for the respective
TRO600 series router version.
For more information, see Hitachi Energy's security advisory 8DBD000147(link is
external)
CISA recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities, such as:
* Minimize network exposure for all control system devices and/or systems,
ensuring they are not accessible from the internet.
* Locate control system networks and remote devices behind firewalls and
isolating them from business networks.
* When remote access is required, use more secure methods, such as Virtual
Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be
updated to the most recent version available, and are only as secure as the
connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment
prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense
best practices are available for reading and download, including Improving
Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov in the technical information paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.
Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.
No known public exploitation specifically targeting these vulnerabilities has
been reported to CISA at this time.
5. UPDATE HISTORY
* November 12, 2024: Initial Publication
This product is provided subject to this Notification and this Privacy &
Use policy.
VENDOR
* Hitachi Energy
TAGS
Sector: Energy Sector
Topics: Industrial Control System Vulnerabilities, Industrial Control Systems
PLEASE SHARE YOUR THOUGHTS
We recently updated our anonymous product survey; we’d welcome your feedback.
RELATED ADVISORIES
Nov 12, 2024
ICS Advisory | ICSA-24-317-03
ROCKWELL AUTOMATION FACTORYTALK VIEW ME
Nov 12, 2024
ICS Advisory | ICSA-24-317-01
SUBNET SOLUTIONS POWERSYSTEM CENTER
Nov 07, 2024
ICS Advisory | ICSA-24-312-01
BECKHOFF AUTOMATION TWINCAT PACKAGE MANAGER
Nov 07, 2024
ICS Advisory | ICSA-24-312-03
BOSCH REXROTH INDRADRIVE
Return to top
* Topics
* Spotlight
* Resources & Tools
* News & Events
* Careers
* About
Cybersecurity & Infrastructure Security Agency
* Facebook
* Twitter
* LinkedIn
* YouTube
* Instagram
* RSS
CISA Central 1-844-Say-CISA SayCISA@cisa.dhs.gov
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
* About CISA
* Budget and Performance
* DHS.gov
* Equal Opportunity & Accessibility
* FOIA Requests
* No FEAR Act
* Office of Inspector General
* Privacy Policy
* Subscribe
* The White House
* USA.gov
* Website Feedback