Hitachi Energy's ITT600 Explorer, a testing tool for power grid communication protocols, has two high-severity denial-of-service vulnerabilities — both tracing back to the libexpat XML parsing library bundled inside it.
The two flaws, CVE-2024-8176 and CVE-2025-59375, affect ITT600 Explorer versions up to and including 2.1 SP6. The first is a stack overflow driven by uncontrolled recursion in libexpat; the second allows an attacker to trigger outsized dynamic memory allocations by submitting a small crafted document for parsing. Both score 7.5 on the CVSS 3.1 scale. In the worse case, CVE-2024-8176 could escalate from a crash to exploitable memory corruption depending on how the library is loaded. Hitachi Energy's own internal security team discovered and reported the bugs.
ITT600 Explorer is used to test IEC 61850 systems — the communication standard that ties together substations and other energy infrastructure deployed worldwide. A crash mid-commissioning or mid-maintenance window is a real operational nuisance, even if it stops short of touching live grid endpoints. The narrowing factor: both vulnerabilities only activate when the product's IEC 61850 server simulation mode is running, which limits who is actually exposed.
The fix is an update to version 2.1 SP6 HF1; version 2.2 is the longer-term path. libexpat has accumulated a steady stream of CVEs over the years, and this advisory is another reminder that embedded XML parsers in industrial tooling tend to age poorly.