Read the docs
TI-2022-03603 Aliases CVE-2022-3928GHSA-vgqf-5fqh-5xqq

Hardcoded credential is found in the message queue

Priority LOW 31CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to access data to the internal message queue. This issue affects * FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Fixed FOXMAN-UN (Hitachi Energy): FOXMAN-UN R16AUNEM (Hitachi Energy): UNEM R16A

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi EnergyFOXMAN-UNFOXMAN-UN R15B; FOXMAN-UN R15A; FOXMAN-UN R14B; FOXMAN-UN R14A; FOXMAN-UN R11B; FOXMAN-UN R11A; FOXMAN-UN R10C; FOXMAN-UN R9CFOXMAN-UN R16APatch availableCNA
Hitachi EnergyUNEMUNEM R15B; UNEM R15A; UNEM R14B; UNEM R14A; UNEM R11B; UNEM R11A; UNEM R10C; UNEM R9CUNEM R16APatch availableCNA
  • FOXMAN-UN VendorHitachi Energy Affected FOXMAN-UN R15B; FOXMAN-UN R15A; FOXMAN-UN R14B; FOXMAN-UN R14A; FOXMAN-UN R11B; FOXMAN-UN R11A; FOXMAN-UN R10C; FOXMAN-UN R9C Fixed in FOXMAN-UN R16A Patch available CNA
  • UNEM VendorHitachi Energy Affected UNEM R15B; UNEM R15A; UNEM R14B; UNEM R14A; UNEM R11B; UNEM R11A; UNEM R10C; UNEM R9C Fixed in UNEM R16A Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hitachienergy:foxman-un:*:*:*:*:*:*:*:*before r16aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:*:*:*:*:*:*:*:*before r16aVulnerableHitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:*:*:*:*:*:*:*:* Versions before r16a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:*:*:*:*:*:*:*:* Versions before r16a Vulnerable ·Hitachi Energy

Remediation

  • Fix · CNA FOXMAN-UN (Hitachi Energy) Fixed in FOXMAN-UN R16A
  • Fix · CNA UNEM (Hitachi Energy) Fixed in UNEM R16A

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3928
  2. 2026-10-03 Alias added: GHSA-vgqf-5fqh-5xqq

References

Advisory 2

  • TI-2024-01871 Heap-based buffer overflow in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
  • TI-2024-01873 Authentication bypass in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 10.0
  • TI-2024-01872 Authentication bypass in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
  • TI-2022-03602 Hard-coded credentials in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
  • TI-2022-03604 Communication between the client and server partially using CORBA over TCP/IP CVSS 3.1CRITICAL 9.8
  • TI-2021-17414 Use of default key for encryption CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences