TI-2024-02287 Aliases CVE-2024-2461 GHSA-89q4-gfxm-xg78

Path traversal in Hitachi Energy FOX61x

LOW 31CWE-23Published 2024-06-11 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00498 42nd percentileScored 2026-11-07

Fix Fixed FOX61x (Hitachi Energy): FOX61x R16B Revision G, version (cesm3_r16b04_07, cesne_r16b04_07 +4XMC20 (Hitachi Energy): XMC20 R16B Revision D, version (cent2_r16b04_07, co5ne_r16b04_07) +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hitachi Energy	FOX61x	up to FOX61x R16B Revision E (cesm3_r16b04_02, cesne_r16b04_02 and f10ne_r16b04_02); FOX61x R15B; FOX61x R16A; FOX61x R15A	FOX61x R16B Revision G, version (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07), FOX61X R16B Revision G, (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07)	Patch available	CNA
Hitachi Energy	XMC20	up to XMC20 R16B Revision C (cent2_r16b04_02, co5ne_r16b04_02); XMC20 R15B; XMC20 R16A; XMC20 R15A	XMC20 R16B Revision D, version (cent2_r16b04_07, co5ne_r16b04_07), XMC20 R16B Revision D, version (cent2_r16b04_07, co5ne_r16b04_07)	Patch available	CNA

FOX61x VendorHitachi Energy Affected up to FOX61x R16B Revision E (cesm3_r16b04_02, cesne_r16b04_02 and f10ne_r16b04_02); FOX61x R15B; FOX61x R16A; FOX61x R15A Fixed in FOX61x R16B Revision G, version (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07), FOX61X R16B Revision G, (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07) Patch available CNA
XMC20 VendorHitachi Energy Affected up to XMC20 R16B Revision C (cent2_r16b04_02, co5ne_r16b04_02); XMC20 R15B; XMC20 R16A; XMC20 R15A Fixed in XMC20 R16B Revision D, version (cent2_r16b04_07, co5ne_r16b04_07), XMC20 R16B Revision D, version (cent2_r16b04_07, co5ne_r16b04_07) Patch available CNA

Remediation

Fix · CNA FOX61x (Hitachi Energy) Fixed in FOX61x R16B Revision G, version (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07), FOX61X R16B Revision G, (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07)
Fix · CNA XMC20 (Hitachi Energy) Fixed in XMC20 R16B Revision D, version (cent2_r16b04_07, co5ne_r16b04_07), XMC20 R16B Revision D, version (cent2_r16b04_07, co5ne_r16b04_07)

Timeline

2026-10-02 Threatist record created from CVE-2024-2461
2026-10-03 Alias added: GHSA-89q4-gfxm-xg78

References

Other 1

https://publisher.hitachienergy.com/preview?DocumentId=8DBD000202&languageCode=en&Preview=true

TI-2019-03985 ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
TI-2018-10635 Improper authentication in ICS-CERT ABB eSOMS CVSS 3.0CRITICAL 9.8
TI-2024-01871 Heap-based buffer overflow in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
TI-2026-07105 Path traversal in Hitachi Energy RTU500 series CMU firmware CVSS 3.1CRITICAL 9.1
TI-2019-13270 Path traversal in Relion 670 Series CVSS 3.1CRITICAL 10.0
TI-2026-07104 Missing authentication in Hitachi Energy RTU500 series CMU firmware CVSS 3.1CRITICAL 9.1

See all 146 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences