OTPulse

Hitachi Energy FACTS Control Platform (FCP)

Plan PatchCVSS 9.9ICS-CERT ICSA-26-260-03Jul 28, 2026
Hitachi EnergyEnergy
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Hitachi Energy FACTS Control Platform (FCP) versions 3.4.0, 3.7.0, 3.8.0 and others contain multiple vulnerabilities in the GWS (Grid World Server) component that allow attackers with engineering credentials to compromise confidentiality, integrity, and availability. The vulnerabilities involve path traversal (CWE-22), authentication bypass (CWE-294, CWE-306), and open redirects (CWE-601). Only FACTS Control systems with the GWS component deployed from 2020 onwards are affected. Impacted products include SVC Light (STATCOM), Fixed Series Capacitors, Thyristor Controlled Series Capacitors, Static Var Compensators, and Hybrid Synchronous Condensers used in power grid voltage and reactive power control.

What this means
What could happen
An attacker with engineering access could run arbitrary code on FACTS Control Platform systems, potentially altering voltage regulation and reactive power compensation setpoints or disrupting grid stability functions in real-time. This affects multiple critical transmission-level control systems across the power grid.
Who's at risk
Power utilities and transmission system operators managing FACTS (Flexible AC Transmission System) devices, particularly those using Hitachi Energy's FACTS Control Platform with GWS component for voltage regulation and reactive power compensation (SVC Light, Static Var Compensators, Thyristor Controlled Series Capacitors, and similar devices). Affects systems deployed from 2020 onwards.
How it could be exploited
An attacker with valid engineering credentials could exploit path traversal, authentication, or code injection vulnerabilities in the GWS (Grid World Server) component to upload and execute arbitrary code on the FACTS Control Platform. The attack requires network access to the management interface and legitimate user credentials.
Prerequisites
  • Valid engineering workstation credentials (username/password or certificate)
  • Network access to FACTS Control Platform management interface (GWS component)
  • FACTS Control Platform with GWS component deployed from 2020 onwards
remotely exploitablelow complexityhigh CVSS score (9.9)affects critical grid stabilization systems
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (1)
ProductAffected VersionsFix Status
FACTS Control Platform (FCP)3.4.03.7.03.8.0 and 8 moreNo fix yet
Remediation & Mitigation
0/5
Do now
0/3
HARDENINGRestrict network access to FACTS Control Platform management interfaces to authorized engineering workstations only using firewall rules or access control lists
HARDENINGEnforce strong authentication and multi-factor authentication for all engineering workstation logins to FACTS Control Platform
HARDENINGMonitor and log all administrative and code upload activities on FACTS Control Platform for detection of unauthorized changes
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXContact Hitachi Energy for available security patches or updated firmware versions for your specific FCP deployment
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate FACTS Control Platform systems from general corporate networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/9a5ab4ba-8525-4fd4-a96d-fb448b08145e

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Hitachi Energy FACTS Control Platform (FCP) | CVSS 9.9 - OTPulse