CISA 2026-07-07

Hitachi Energy PROMOD V

CVE-2026-10763

Machine-generated analysis · WAYSCloud LLM

The advisory states that PROMOD V versions 1.0.10 and prior use HTTP instead of HTTPS due to lack of HTTPS support in the third-party Digipede server, exposing data in transit.

Context

PROMOD V is a product developed by Hitachi Energy, used in the energy sector. The advisory identifies a vulnerability where the product relies on HTTP for communication, which could allow interception or manipulation of data. This issue stems from the Digipede server, a third-party component, not supporting HTTPS. The vendor attributes the vulnerability to this external dependency.

Operator considerations

- Patch: Upgrade to PROMOD V version 1.0.11 and enable HTTPS on the Digipede server as instructed in the user guide or online help.
- Check: Verify the current version of PROMOD V and the configuration of the Digipede server.
- Log: Monitor network traffic for unencrypted HTTP communications involving PROMOD V systems.

From Cybersecurity and Infrastructure Security Agency ↗

Hitachi Energy is aware of insecure HTTP transmission vulnerability in PROMOD V product versions listed in this document. This vulnerability could allow attackers to intercept or manipulate sensitive data in transit, potentially leading to credential theft, session hijacking, or unauthorized access.

The following versions of Hitachi Energy PROMOD V are affected:

PROMOD V vers:PROMOD_V/Running PROMOD V->Digipede Grid. Alternatively, refer to the same section in the online help contained in the application.

MitigationApply general mitigation factors

Relevant CWE: CWE-1428 Reliance on HTTP instead of HTTPS

Metrics

Base Score

Base Severity

Vector String

3.1

7.1

HIGH

4.0

7

HIGH

Acknowledgments

Hitachi Energy Internal Team

Notice

The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energ...

Read the full advisory on CISA →