Read the docs
TI-2024-01872 Aliases CVE-2024-2012GHSA-73c8-ph6w-g64x

Authentication bypass in Hitachi Energy FOXMAN-UN

Priority MEDIUM 44CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-288.

Summary

vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allowing sensitive data to be read or modified or could cause other unintended behavior

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00601 48th percentileScored 2026-11-07
Fix Fixed FOXMAN-UN (Hitachi Energy): FOXMAN-UN R16B PC3, FOXMAN-UN R15B PC5UNEM (Hitachi Energy): UNEM R16B PC3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi EnergyFOXMAN-UNFOXMAN-UN R16B PC2; FOXMAN-UN R15B PC4; FOXMAN-UN R16A; FOXMAN-UN R15AFOXMAN-UN R16B PC3, FOXMAN-UN R15B PC5Patch availableCNA
Hitachi EnergyUNEMUNEM R16B PC2; UNEM R15B PC4; UNEM R15B PC5; UNEM R15A; UNEM R16AUNEM R16B PC3Patch availableCNA
  • FOXMAN-UN VendorHitachi Energy Affected FOXMAN-UN R16B PC2; FOXMAN-UN R15B PC4; FOXMAN-UN R16A; FOXMAN-UN R15A Fixed in FOXMAN-UN R16B PC3, FOXMAN-UN R15B PC5 Patch available CNA
  • UNEM VendorHitachi Energy Affected UNEM R16B PC2; UNEM R15B PC4; UNEM R15B PC5; UNEM R15A; UNEM R16A Fixed in UNEM R16B PC3 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:hitachienergy:foxman-un:r15a:*:*:*:*:*:*:*r15aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r15b:pc4:*:*:*:*:*:*r15b pc4VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r16a:*:*:*:*:*:*:*r16aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r16b:pc2:*:*:*:*:*:*r16b pc2VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r15a:*:*:*:*:*:*:*r15aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r15b:pc4:*:*:*:*:*:*r15b pc4VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r15b:pc5:*:*:*:*:*:*r15b pc5VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r16a:*:*:*:*:*:*:*r16aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r16b:pc2:*:*:*:*:*:*r16b pc2VulnerableHitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r15a:*:*:*:*:*:*:* Versions r15a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r15b:pc4:*:*:*:*:*:* Versions r15b pc4 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r16a:*:*:*:*:*:*:* Versions r16a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r16b:pc2:*:*:*:*:*:* Versions r16b pc2 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r15a:*:*:*:*:*:*:* Versions r15a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r15b:pc4:*:*:*:*:*:* Versions r15b pc4 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r15b:pc5:*:*:*:*:*:* Versions r15b pc5 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r16a:*:*:*:*:*:*:* Versions r16a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r16b:pc2:*:*:*:*:*:* Versions r16b pc2 Vulnerable ·Hitachi Energy

Remediation

  • Fix · CNA FOXMAN-UN (Hitachi Energy) Fixed in FOXMAN-UN R16B PC3, FOXMAN-UN R15B PC5
  • Fix · CNA UNEM (Hitachi Energy) Fixed in UNEM R16B PC3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2012
  2. 2026-10-03 Alias added: GHSA-73c8-ph6w-g64x

References

Advisory 1

  • TI-2024-01871 Heap-based buffer overflow in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
  • TI-2024-01873 Authentication bypass in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 10.0
  • TI-2022-03602 Hard-coded credentials in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
  • TI-2022-03604 Communication between the client and server partially using CORBA over TCP/IP CVSS 3.1CRITICAL 9.8
  • TI-2021-17414 Use of default key for encryption CVSS 3.1CRITICAL 9.8
  • TI-2024-18618 A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server… CVSS 3.1HIGH 8.0
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences