TI-2023-05076 Aliases CVE-2023-5516 GHSA-prpr-2cpp-jg5f

Information disclosure in Hitachi Energy eSOMS

LOW 30CWE-200Published 2023-11-01 · Updated 2025-02-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints, backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0045 39th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hitachi Energy	eSOMS	6.0 – 6.3.13	—	No fix listed	CNA

eSOMS VendorHitachi Energy Affected 6.0 – 6.3.13 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hitachienergy:esoms::::::::	up to 6.3.13	Vulnerable	Hitachi Energy

cpe:2.3:a:hitachienergy:esoms:*:*:*:*:*:*:*:* Versions up to 6.3.13 Vulnerable ·Hitachi Energy

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-5516
2026-10-03 Alias added: GHSA-prpr-2cpp-jg5f

References

Advisory 1

https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true

TI-2018-10635 Improper authentication in ICS-CERT ABB eSOMS CVSS 3.0CRITICAL 9.8
TI-2021-14258 Password Autocomplete Vulnerability in Hitachi ABB Power Grids eSOMS Application CVSS 3.1HIGH 7.5
TI-2021-08463 eSOMS Report Function Vulnerability CVSS 3.1HIGH 7.5
TI-2019-13779 ABB eSOMS: SQL injection vulnerability CVSS 3.1HIGH 7.6
TI-2019-13782 ABB eSOMS: SSL medium strength Cipher Suites CVSS 3.1HIGH 7.5
TI-2019-13693 eSOMS X-FrameOption CVSS 3.1MEDIUM 6.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences