Hitachi Energy Discloses a 9.9 Flaw With No Patch Version

An authenticated attacker with low-level access could inject code into stored data on Hitachi Energy's FACTS Control Platform, software used to help stabilize power grids, exploiting a flaw CISA rated 9.9 out of 10 on the CVSS severity scale in an advisory published Sept. 17. Hitachi Energy has not named a version that fixes it; the advisory tells customers to contact their service provider instead.

What CVE-2024-4872 lets an attacker do

The flaw, tracked as CVE-2024-4872, is one of five vulnerabilities CISA disclosed in Hitachi Energy's FACTS Control Platform (FCP) on Sept. 17, alongside CVE-2024-3980, also rated 9.9, a path-traversal flaw that lets an authenticated attacker access or modify critical system files. Three lower-severity flaws round out the advisory: CVE-2024-3982 (8.2, session hijacking through an authentication bypass, usable only by a local attacker who already holds admin privileges), CVE-2024-7940 (8.3, missing authentication for a function meant to stay local-only) and CVE-2024-7941 (4.3, an open redirect that could be used to steal login credentials through phishing). The affected versions span FCP 3.4.0 through 4.1.1, wherever the platform's GWS component has been deployed since 2020, according to CISA. Hitachi Energy reported the flaws itself and points customers to its own advisory, numbered 8DBD000229, rather than to a specific patched build.

Three more vendors, three different patch stories

CISA published three more industrial control system advisories the same week, each answering the question a Hitachi Energy customer cannot yet get answered: what version fixes it.

Vendor	Product	Highest CVSS	Patch available
Hitachi Energy	FACTS Control Platform	9.9	No version named
ABB	Ability Edgenius	7.8	Yes, version 3.2.4.1
Mitsubishi Electric	CC-Link IE TSN devices	7.1	No, mitigations only
Schneider Electric	PowerChute Serial Shutdown	5.3	Yes, version 1.6

ABB's flaw, CVE-2026-31431, lets a locally authenticated user or a compromised container workload gain root privileges on Ability Edgenius versions from 3.2.0.0 up to but not including 3.2.4.1, which carries the fix. ABB said it has no information indicating the flaw has been exploited. Schneider Electric's flaw, CVE-2026-13348, lets an attacker keep guessing passwords against PowerChute Serial Shutdown without a rate limit when redirect handling is disabled; version 1.6 restores it, and Schneider's own CPCERT team reported the issue internally.

Mitsubishi Electric's flaw has neither a patch nor a small blast radius. CVE-2026-13584 lets an unauthenticated attacker on the same network segment tamper with control signals and output values on more than 80 affected product families, including MELSEC controllers, motion modules, servo drives and GOT3000 human-machine interfaces, and CISA's Sept. 17 update to the advisory added eight more affected products while removing three others. Alessandro Di Pinto, Giovanni Dini Gentilini, Luca Cremona and Gabriele Quagliarella of Nozomi Networks reported the flaw. With no vendor patch available, Mitsubishi Electric's advice is limited to network isolation, physical access controls and credential management.

NVD scores the same flaw at 8.8, not 9.9

CVE-2024-4872 was published to the National Vulnerability Database on Aug. 27, 2024, more than two years before CISA's Sept. 17, 2026 advisory covering the FACTS Control Platform. NVD's own record lists a base score of 8.8, using a vector with an unchanged scope (S:U), and describes the affected product as MicroSCADA Pro/X SYS600, a separate Hitachi Energy product that shares the vulnerable GWS component with FCP. CISA's advisory scores the identical CVE number at 9.9 for the FACTS Control Platform, using a vector with a changed scope (S:C), which raises the score by widening the assumed blast radius beyond the vulnerable component itself. Neither record explains why the two disagree on scope for what is, by CVE number, the same flaw, and Hitachi Energy's own advisory, 8DBD000229, is not itself public.

What none of the four vendors has said

None of the four advisories reports exploitation in the wild. But absence of evidence is not the same claim as absence of risk: Mitsubishi Electric's flaw needs no authentication and no user interaction, and covers more than 80 product families with no fix available industrywide. Hitachi Energy has not said how many FACTS Control Platform deployments run the vulnerable GWS component or how many of those sit on internet-facing networks. Without that count, a 9.9 severity score describes what the flaw could do to a single exposed system, not how many grid operators are exposed to it today.

The gap between a severity score and a patch also showed up in The Terminal's coverage of a discrepancy between CISA's and NVD's scoring of three Linux kernel bugs, and in Cisco's confirmation that both the Sandworm and Qilin groups exploited the same firewall software months after a patch existed. In each case, the number on the advisory told only part of the story an operator needed to act on.

A grid operator reading Hitachi Energy's advisory today has to make a decision with less information than an ABB or Schneider Electric customer reading theirs the same week: whether to take a FACTS Control Platform deployment offline, restrict it to an isolated network, or wait for a patched build that, as of Sept. 20, does not have a public version number attached to it anywhere in the advisory.