TLP:CLEARR E V IS IO N : 1P U B L IC AT IO N D AT E : 2 0 2 3 - 0 9 -0 8
D O C . ID E N T IF IE R : 8 D B D 0 0 0 1 7 2P U B L IS H E R : H ITA C H I E N E R G Y P S IR T
D O C U ME N T S TAT U S : F IN A L

CYBERSECURITY ADVISORY

Tag Out Vulnerability in Hitachi Energy’s
Asset Suite 9 productCVE-2023-4816

Notice
The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes noresponsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental, or consequential damages of any nature or kind arisingfrom the use of this document, or from the use of any hardware or software described in this document, even ifHitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts
hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents
hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations
and trademarks reside with their respective owners.

© Copyright 2023 Hitachi Energy. All rights reserved.

1/4

CYBE RSE CURI TY ADV I SO RY

SummaryHitachi Energy is aware of a reported vulnerability that affects the Asset Suite product version 9 Equipment Tag
Out, when configured with Single Sign-On (SSO) password validation in T214. This vulnerability can be exploited by an authenticated user performing an Equipment Tag Out holder action for another user.
Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

Vulnerability ID, Severity and Details
The vulnerability’s severity assessment is performed by using the FIRST Common Vulnerability Scoring System(CVSS) v3.1. The CVSS Environmental Score, which can affect the final vulnerability severity score, is not provided in this advisory as it reflects the potential impact of the vulnerability in the customer organizations’ computing environment. Customers are recommended to analyze the impact of the vulnerability in their environmentand calculate the CVSS Environmental Score.
Vulnerability ID

Detail Description

CVE-2023-4816

A vulnerability exists in the Equipment Tag Out authentication,

CVSS v3.1 Base Score: 6.9 MEDIUM

when configured with Single Sign-On (SSO) with password valida-

CVSS v3.1 Vector: AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:Ltion in T214.

Link to NVD: click hereThis vulnerability can be exploited by an authenticated user per-CWE-287: Improper Authentication

forming an Equipment Tag Out holder action (Accept, Release, andClear) for another user and entering an arbitrary password in theholder action confirmation dialog box. Despite entering an arbitrary
password in the confirmation box, the system will execute the selected holder action.

Affected Product Versions & Recommended Immediate
Actions
The Table below shows the affected version and the recommended immediate actions.
Affected Version

Recommended Actions

Asset Suite 9.6.3.11.1 and below

Apply one of the described mitigation strategies:

and1.

Configure Asset Suite 9 with a different authentication method other than SSO.

Asset Suite 9.6.4

2.

Configure Asset Suite security to disallow holder actions to be taken on behalf of other
employees by removing authorization for the following security events to all users:
T214ACT, T214RLS, and T214CLR.

3.

Set Equipment Tag Out preference ‘C/O HOLDER PSWD’ to ‘N’.

Hitachi Energy recommends that customers affected by this vulnerability should apply one ofthe provided mitigation methods until a fix has been delivered in a patch. **Upgrade to Asset Suite version that fixes the vulnerability when available – remediation is under development.

© Copyright 2023 Hitachi Energy. All rights reserved.

2/4

CYBE RSE CURI TY ADV I SO RY

General Mitigation Factors/Workarounds
Recommended security practices and firewall configurations can help protect a process control network fromattacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, andare separated from other networks by means of a firewall system that has a minimal number of ports exposed,and others that have to be evaluated case by case. Process control systems should not be used for Internet
surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be
carefully scanned for viruses before they are connected to a control system.

Frequently Asked Questions
What is Hitachi Energy Asset Suite?
Asset Suite EAM (Enterprise Asset Management) for conventional and nuclear power generation is specificallydesigned to address the unique challenges faced by power generation operations, driven by utility requirements
and implemented by utility-experienced teams.
Asset Suite EAM enables standardizing and streamlining work processes to maximize worker productivity, andimproves ROI on assets through increased availability, reduced planned outage time, and improved reliability.

How could the vulnerability be exploited, and impact caused?
An authorized and authenticated user in the system, could perform a holder action on T214 on behalf of anotheruser despite entering an arbitrary password. This vulnerability can potentially pose a safety hazard, if the user
holder action was carried out unintentionally.

Could the vulnerability be exploited remotely?
Yes, any user with the ability to use the system remotely and the proper Asset Suite security privileges to perform holder actions on behalf of other users can exploit the vulnerability.

When this security advisory was issued, had this vulnerability been publicly
disclosed?
No, this vulnerability was not publicly disclosed. Hitachi Energy received information about this vulnerability
through a stakeholder.

When this security advisory was issued, had Hitachi Energy received any reportthat this vulnerability was being exploited?
No, at the date of this advisory publication Hitachi Energy had not received any information indicating that thisvulnerability had been exploited.

SupportFor additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.

© Copyright 2023 Hitachi Energy. All rights reserved.

3/4

CYBE RSE CURI TY ADV I SO RY

Publisher
Hitachi Energy PSIRT – cybersecurity@hitachienergy.com

Revision
Date of theRevision

Revision

Description

2023-09-08

1

Initial public release.

© Copyright 2023 Hitachi Energy. All rights reserved.

4/4