CVE-2021-40341

DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B...

Code injection

DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B...

Design/Logic Flaw

In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. This issue affects FOXMAN-UN product:...

CVE-2022-3929 Communication between the client and server partially using CORBA over TCP/IP

Communication between the client and the server application of the affected products is partially done using CORBA Common Object Request Broker Architecture over TCP/IP. This protocol is not encrypted and allows tracing of internal messages. This issue affects FOXMAN-UN product: FOXMAN-UN R15B,...

CVE-2022-3929

CVE-2022-3929 affects Hitachi Energy products FOXMAN-UN and UNEM (R9C–R15B). The issue arises from client–server communication partially using CORBA over TCP/IP, which is not encrypted and can allow tracing of internal messages. Public advisories indicate remediation is to upgrade to newer releas...

CVE-2022-3927

CVE-2022-3927 concerns Hitachi Energy FOXMAN-UN and UNEM products. The issue arises from storing public and private keys used to sign and protect Custom Parameter Set (CPS) files, enabling an attacker to modify a CPS and sign it as legitimate. Affected products/versions: FOXMAN-UN R9C–R15B and UN...

CVE-2021-40342

CVE-2021-40342 affects Hitachi Energy FOXMAN-UN and UNEM products (FOXMAN-UN R9C–R16A; UNEM R9C–R16A). Root cause: DES encryption uses a default key. Impact: an attacker could obtain sensitive information and gain access to network elements managed by the affected products. Mitigation/remediation...

CVE-2021-40342 Use of default key for encryption

In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. This issue affects FOXMAN-UN product:...

CVE-2021-40341 Weak DES encryption

DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B...

CVE-2021-40341

CVE-2021-40341 involves the use of DES to encrypt user credentials in Hitachi Energy FOXMAN-UN and UNEM network-management products. The affected families span FOXMAN-UN R9C–R16A and UNEM R9C–R16A. The root cause is the inadequate encryption strength of DES (56-bit key), which enables decryption ...

Hitachi FOXMAN-UN 安全漏洞

Hitachi FOXMAN-UN is a powerful toolset for a comprehensive NMS suite from Hitachi, Japan. A security vulnerability exists in Hitachi FOXMAN-UN that stems from the fact that the communication between its client FOXMAN-UN User Interface and server application FOXMAN-UN Core partially uses CORBA...

PT-2023-12361 · Hitachi Energy · Hitachi Energy Foxman-Un +1

Name of the Vulnerable Software and Affected Versions: Hitachi Energy FOXMAN-UN versions R9C through R16A Hitachi Energy UNEM versions R9C through R16A Description: The DES cipher, which has inadequate encryption strength, is used in Hitachi Energy FOXMAN-UN to encrypt user credentials used to...

Hitachi FOXMAN-UN 授权问题漏洞

Hitachi FOXMAN-UN is a powerful toolset for a comprehensive NMS suite from Hitachi, Japan. An authorization issue vulnerability exists in Hitachi FOXMAN-UN, which stems from its use of a DES implementation with a default key for encryption that allows an attacker to obtain sensitive information a...

Hitachi Energy Lumada Asset Performance Management

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Lumada Asset Performance Management APM Vulnerabilities: Classic Buffer Overflow, Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

Hitachi Energy FOXMAN-UN

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: FOXMAN-UN Vulnerabilities: Inadequate Encryption Strength, Use of Default Cryptographic Key, Use of Hard-coded Cryptographic Key, Cleartext Transmission of Sensitive...

Hitachi FOXMAN-UN 信任管理问题漏洞

Hitachi FOXMAN-UN is a powerful toolset for a comprehensive NMS suite from Hitachi, Japan. A security vulnerability exists in Hitachi FOXMAN-UN, which stems from the fact that it contains public and private keys used to sign and protect Custom Parameter Sets CPS files from modification, allowing ...

Hitachi FOXMAN-UN 信任管理问题漏洞

Hitachi FOXMAN-UN is a powerful toolset for a comprehensive NMS suite from Hitachi, Japan. A security vulnerability exists in Hitachi FOXMAN-UN, which stems from the fact that its message queue contains hard-coded credentials that allow an attacker to access data from the internal message queue...

Hitachi Energy UNEM

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: UNEM Vulnerabilities: Inadequate Encryption Strength, Use of Hard-coded Cryptographic Key, Cleartext Transmission of Sensitive Information. 2. RISK EVALUATION Successful...

Hitachi FOXMAN-UN 加密问题漏洞

Hitachi FOXMAN-UN is a powerful toolset for a comprehensive NMS suite from Hitachi, Japan. Hitachi FOXMAN-UN has a security vulnerability that stems from its use of DES ciphers to encrypt user credentials used to access network elements.DES is no longer considered secure because its short 56-bit...

CISA Releases Three Industrial Systems Control Advisories

CISA released three Industrial Control Systems ICS advisories on January 5, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for...