OTPulse

Hitachi Energy Asset Suite

Plan PatchCVSS 8.1ICS-CERT ICSA-26-279-03Sep 29, 2026
Hitachi EnergyEnergy
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Hitachi Energy Asset Suite versions 9.9.0 and earlier contain unauthenticated servlet access vulnerabilities. Five servlets—HTTPPublishAdapterTestServlet, PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet—can be accessed without credentials over the network. An attacker can exploit these to read sensitive configuration data, modify settings, or disrupt asset management operations. The HTTPPublishAdapterTestServlet is intended for non-production testing only. The other servlets provide production functionality but should be evaluated for necessity and disabled if not required.

What this means
What could happen
An attacker could access Hitachi Energy Asset Suite remotely without credentials and read, modify, or potentially disrupt energy management data and configurations. This could affect power generation, distribution, or asset monitoring operations.
Who's at risk
Energy sector organizations using Hitachi Energy Asset Suite versions 9.9.0 and earlier should prioritize this. Asset Suite is used for managing energy infrastructure assets, monitoring, and configuration across power generation, transmission, and distribution systems. IT/OT personnel responsible for these systems need to assess exposure.
How it could be exploited
An attacker on the network (or internet, if the Asset Suite web interface is exposed) sends HTTP requests to unauthenticated servlets. The vulnerable servlets (HTTPPublishAdapterTestServlet, PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, ResourceBundleReloadServlet) accept requests without login and allow the attacker to view sensitive data, reload configurations, or clear caches that may disrupt normal operation.
Prerequisites
  • Network access to the Asset Suite web interface (typically port 80 or 443)
  • No authentication required
Remotely exploitableNo authentication requiredLow complexityAffects energy infrastructure management
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
Asset Suite≤ 9.9.0Fix available
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDDisable HTTPPublishAdapterTestServlet immediately, as it is intended only for non-production testing environments
WORKAROUNDDisable or restrict access to PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet unless required for production operations; evaluate if these servlets are actually needed and disable if possible
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Asset Suite to version 9.9.1 or later when available from Hitachi Energy
Long-term hardening
0/1
HARDENINGImplement firewall rules to restrict access to the Asset Suite web interface to authorized engineering workstations and control center networks only
View full CISA ICS-CERT advisory
API: /api/v1/advisories/993a6756-c2ae-43db-a659-bc814fbeb948

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Hitachi Energy Asset Suite | CVSS 8.1 - OTPulse