Five Hitachi Energy FCP Flaws Expose Grid-Control Systems to Data, File and Session Attacks

Hitachi Energy has disclosed five vulnerabilities in its FACTS Control Platform that could compromise data, system files, authenticated sessions and operational availability. The most severe defects carry CVSS v3.1 scores of 9.9 out of 10.

The exposure is conditional: affected FACTS Control Platform releases are vulnerable only when the GWS component is installed. Deployments without GWS are not affected. Systems installed from 2020 onward are considered likely to be exposed if they include that component.

The technology supports Flexible AC Transmission Systems and related power-grid applications worldwide. Because fixed releases have not been identified, operators must currently rely on network isolation, access restrictions, monitoring and vendor-specific remediation guidance.

GWS determines which installations are exposed

The affected product is the Hitachi Energy FACTS Control Platform, or FCP. It is used across several applications that manage or support electrical transmission infrastructure:

• SVC Light (STATCOM)
• Fixed Series Capacitor
• Thyristor Controlled Series Capacitor
• Static Var Compensator
• Static Watt Compensator
• Hybrid Synchronous Condensers

The vulnerable release set comprises FCP versions 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1. However, those releases are affected only when GWS is present.

That distinction should guide the initial response. Operators first need to inventory their FACTS Control installations, identify the deployed FCP release and verify whether each system contains GWS. Deployments dating from 2020 onward deserve priority during this review.

The vulnerabilities span several security boundaries. Four of the five CVSS vectors indicate changed scope, meaning exploitation can affect resources beyond the vulnerable component’s original security authority.

Injection and path traversal receive Critical ratings

The two most serious vulnerabilities share a CVSS v3.1 score of 9.9 and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Both are remotely reachable, require limited privileges and can produce high confidentiality, integrity and availability impacts.

CVE-2024-4872 is an improper neutralization flaw in data-query logic, classified as CWE-943. The platform’s query-validation mechanism can allow an authenticated attacker to inject code targeting persistent data.

Valid credentials are required, so the flaw does not provide an unauthenticated entry point. Nevertheless, an attacker holding a low-privilege account could potentially alter stored information or otherwise interfere with data used by the application. The affected releases are every listed version from 3.4.0 through 4.1.1.

CVE-2024-3980 is a path-traversal vulnerability classified as CWE-22. An authenticated user can influence paths or filenames passed to filesystem operations, potentially escaping the intended directory boundaries.

Successful exploitation may expose system files or allow modification of files required by the application. It affects the same full release set as CVE-2024-4872 and carries the same network-accessible, low-complexity attack profile.

These flaws are particularly relevant where credentials have already been stolen, shared improperly or obtained through another intrusion path. They can turn authenticated access into broader compromise of application data and the underlying file environment.

Session replay and an exposed service widen the attack surface

The remaining vulnerabilities involve different prerequisites and affect narrower version ranges.

CVE-2024-3982, rated 8.2 High, enables authentication bypass through capture-replay. It affects versions 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1.

An attacker with local access can activate product session logging and attempt to hijack an existing session. This path requires administrator privileges because session logging is disabled by default and only administrators can enable it.

Those conditions narrow the attack scenario, but they do not eliminate its impact. A malicious administrator or an attacker who has already obtained local administrative control could capture and replay session material to bypass authentication. Its vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

CVE-2024-7940 exposes a function intended for local access on every network interface without authentication. The flaw affects versions 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1.

The vulnerability is rated 8.3 High, with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. It requires no privileges, although exploitation has high complexity and depends on user interaction. The key defensive concern is that a local-only service has become part of the reachable network attack surface.

Operators should therefore inspect the interfaces on which affected services listen, not merely check whether the systems are directly exposed to the Internet.

An open redirect can support credential phishing

CVE-2024-7941 is an open-redirect vulnerability affecting only versions 3.15.0, 4.1.0 and 4.1.1. It has a 4.3 Medium rating and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

An HTTP parameter accepts a URL and can redirect the user’s request to a destination supplied by an attacker. A manipulated link could consequently send personnel from an apparently legitimate FCP address to a malicious website.

The flaw does not directly create the broad system compromise associated with the Critical vulnerabilities. Its practical use is social engineering: an attacker could imitate an authentication page and attempt to collect credentials from operators or administrators.

That scenario is relevant because valid credentials are a prerequisite for exploiting CVE-2024-4872 and CVE-2024-3980. No direct chaining between the vulnerabilities has been documented, however.

No fixed FCP releases have been specified

As of September 18, 2026, no remediation release or vendor patch version has been identified for the affected FCP branches. Organizations should contact their product provider or Hitachi Energy service organization for instructions tailored to their installation.

Until an approved remediation is available, operators should:

1. Remove direct Internet exposure. FACTS Control devices and supporting hosts should not be publicly reachable.
2. Segment control environments. Place operational systems behind firewalls and separate them from corporate and other less-trusted networks.
3. Reduce reachable services. Permit only required protocols, ports, hosts and administrative paths.
4. Protect remote access. Use maintained VPN infrastructure where remote connectivity is operationally necessary, while also securing connected endpoints.
5. Review privileged accounts. Restrict administrative access and investigate accounts capable of enabling session logging.
6. Protect physical access. CVE-2024-3982 depends on local access, making workstation and facility controls directly relevant.
7. Keep control workstations task-specific. They should not be used for email, general web browsing or instant messaging.
8. Scan portable devices and media. Laptops and removable storage should be checked before connection to control systems.

Monitoring should focus on unexpected authentication events, session-logging changes, unusual reads or modifications of system files, unexplained changes to persistent data and services listening on unintended network interfaces. Operators should also investigate FCP links that redirect users to unfamiliar domains.

Active exploitation and KEV status remain unconfirmed

Hitachi Energy reported the five issues to CISA, which published an industrial control systems advisory. The recorded SSVC entry is SSVCv2/E:N/A:N/2026-07-24T09:43:32Z/.

The available information does not establish that any of the five vulnerabilities has been added to CISA’s Known Exploited Vulnerabilities catalog. Consequently, no KEV addition date or federal remediation deadline is known. Active exploitation has not been confirmed.

That leaves operators facing serious but not publicly verified in-the-wild attack paths. The immediate priorities are to identify GWS-equipped systems, isolate reachable services and obtain product-specific remediation guidance.