Analysis Summary

CVE-2025-2500 CVSS:7.4

A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product, and the time window of a possible password attack could be expanded.

CVE-2025-1484 CVSS:6.5

A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confidentiality or integrity of the system. An attacker can use this vulnerability to construct a request that will cause JavaScript code supplied by the attacker to execute within the user’s browser in the context of that user’s session with the application.

Impact

• Gain Access
• Code Execution

Indicators of Compromise

CVE

• CVE-2025-2500

• CVE-2025-1484

Affected Vendors

Remediation

Refer to Hitachi Energy Security Advisory for patch, upgrade or suggested workaround information.

Hitachi Energy Security Advisory