--- title: "Hitachi Energy FOXMAN-UN vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/hitachi-energy/foxman-un type: product description: "Hitachi Energy FOXMAN-UN has 15 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2024-06-11 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Hitachi Energy FOXMAN-UN vulnerabilities Vendor: [Hitachi Energy](https://radicalnotion.ai/vendor/hitachi-energy) - **Published CVEs:** 15 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 10 - **Average CVSS:** 7.7 - **First CVE:** 2023-01-05 - **Latest CVE:** 2024-06-11 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 6 | | High | 4 | | Medium | 5 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-798](https://radicalnotion.ai/cwe/cwe-798) | Use of Hard-coded Credentials | 3 | | [CWE-288](https://radicalnotion.ai/cwe/cwe-288) | Authentication Bypass Using an Alternate Path or Channel | 2 | | [CWE-259](https://radicalnotion.ai/cwe/cwe-259) | Use of Hard-coded Password | 1 | | [CWE-286](https://radicalnotion.ai/cwe/cwe-286) | Incorrect User Management | 1 | | [CWE-295](https://radicalnotion.ai/cwe/cwe-295) | Improper Certificate Validation | 1 | | [CWE-117](https://radicalnotion.ai/cwe/cwe-117) | Improper Output Neutralization for Logs | 1 | | [CWE-307](https://radicalnotion.ai/cwe/cwe-307) | Improper Restriction of Excessive Authentication Attempts | 1 | | [CWE-312](https://radicalnotion.ai/cwe/cwe-312) | Cleartext Storage of Sensitive Information | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2023 | 6 | | 2024 | 9 | ## Affected versions (top 29 of 40) | Version | Kind | CVEs | | --- | --- | --- | | FOXMAN-UN R15A | exact | 12 | | FOXMAN-UN R15B | exact | 9 | | FOXMAN-UN R16A | exact | 9 | | FOXMAN-UN R10C | exact | 6 | | FOXMAN-UN R11A | exact | 6 | | FOXMAN-UN R11B | exact | 6 | | FOXMAN-UN R14A | exact | 6 | | FOXMAN-UN R14B | exact | 6 | | FOXMAN-UN R9C | exact | 6 | | FOXMAN-UN R15B PC4 | exact | 5 | | FOXMAN-UN R16B PC2 | exact | 5 | | FOXMAN-UN R16B | exact | 3 | | r15b | range | 10 | | r15a | range | 9 | | r16a | range | 9 | | r16b | range | 7 | | \>= FOXMAN-UN R15B PC5 | range | 5 | | \< r16a | range | 3 | | \>= FOXMAN-UN R16A | range | 3 | | r10c | range | 3 | | r11a | range | 3 | | r11b | range | 3 | | r14a | range | 3 | | r14b | range | 3 | | FOXMAN-UN R16B PC3 | patched | 6 | | FOXMAN-UN R15B PC5 | patched | 5 | | FOXMAN-UN R16A | patched | 3 | | r16a | patched | 3 | | FOXMAN-UN R16B PC5 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2024-28020 | - | high | 8.0 | No | No | No | | CVE-2024-28024 | - | medium | 4.1 | No | No | No | | CVE-2024-28022 | - | medium | 6.5 | No | No | No | | CVE-2024-28023 | - | medium | 5.7 | No | No | Yes | | CVE-2024-28021 | - | high | 7.4 | No | No | Yes | | CVE-2024-2011 | - | critical | 9.8 | No | No | Yes | | CVE-2024-2012 | - | critical | 9.8 | No | No | Yes | | CVE-2024-2013 | - | critical | 10.0 | No | No | Yes | | CVE-2024-2462 | - | medium | 6.8 | No | No | Yes | | CVE-2023-1711 | - | medium | 4.4 | No | No | Yes | | CVE-2022-3929 | Communication between the client and server partially using CORBA over TCP/IP | critical | 9.8 | No | No | Yes | | CVE-2022-3928 | Hardcoded credential is found in the message queue | high | 7.1 | No | No | Yes | | CVE-2022-3927 | The affected products store public and private key that are used to sign and protect custom parameter set files from modification. | critical | 9.8 | No | No | Yes | | CVE-2021-40342 | Use of default key for encryption | critical | 9.8 | No | No | No | | CVE-2021-40341 | Weak DES encryption | high | 7.1 | No | No | No | ## Frequently asked questions ### How many CVEs does Hitachi Energy FOXMAN-UN have? Hitachi Energy FOXMAN-UN has 15 published CVE records since 2023. ### How many Hitachi Energy FOXMAN-UN CVEs are in CISA KEV? None of Hitachi Energy FOXMAN-UN's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Hitachi Energy FOXMAN-UN vulnerabilities? No Hitachi Energy FOXMAN-UN CVEs currently have a tracked public exploit in this dataset. ### Which versions of Hitachi Energy FOXMAN-UN are affected? 40 distinct Hitachi Energy FOXMAN-UN versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Hitachi Energy FOXMAN-UN CVEs? Hitachi Energy FOXMAN-UN's CVEs most often map to these CWE weakness types: CWE-798 (Use of Hard-coded Credentials), CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CWE-259 (Use of Hard-coded Password), CWE-286 (Incorrect User Management). ### How many critical Hitachi Energy FOXMAN-UN vulnerabilities are there? Hitachi Energy FOXMAN-UN has 6 critical and 4 high-severity CVEs. ### What is the average severity of Hitachi Energy FOXMAN-UN CVEs? The average CVSS base score across Hitachi Energy FOXMAN-UN's scored CVEs is 7.7. ## Other products from this vendor - [MicroSCADA X SYS600](https://radicalnotion.ai/vendor/hitachi-energy/microscada-x-sys600) (20 CVEs) - [eSOMS](https://radicalnotion.ai/vendor/hitachi-energy/esoms) (19 CVEs) - [UNEM](https://radicalnotion.ai/vendor/hitachi-energy/unem) (15 CVEs) - [RTU500](https://radicalnotion.ai/vendor/hitachi-energy/rtu500) (13 CVEs) - [RTU500 series CMU firmware](https://radicalnotion.ai/vendor/hitachi-energy/rtu500-series-cmu-firmware) (13 CVEs) - [Asset Suite](https://radicalnotion.ai/vendor/hitachi-energy/asset-suite) (8 CVEs) - [MicroSCADA SYS600](https://radicalnotion.ai/vendor/hitachi-energy/microscada-sys600) (8 CVEs) - [relion 670](https://radicalnotion.ai/vendor/hitachi-energy/relion-670) (8 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/hitachi-energy/foxman-un). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.