[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-hitachi-energy-patches-critical-flaws-in-asset-suite-software":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},10378,"hitachi-energy-patches-critical-flaws-in-asset-suite-software","Hitachi Energy Patches Critical Flaws in Asset Suite Software","Two unauthenticated servlet flaws let attackers tamper with energy-grid asset records or crash the software outright, and a full fix is not out yet.","Hitachi Energy's asset-management software for power utilities has two holes that do not require a password to walk through.\n\nThe vendor and CISA disclosed two vulnerabilities in Asset Suite, the inventory and maintenance-tracking software deployed at energy facilities worldwide. Version 9.9.0 and earlier ship with several servlets - diagnostic tools meant only for testing - that anyone on the network can reach without logging in. One, CVE-2026-7395, rated 8.1 on the CVSS scale, lets an attacker upload configuration files and compromise the system's integrity, while the other, CVE-2026-11796, covers four more servlets that can be abused to crash the application. French utility EDF found and reported both issues.\n\nAsset Suite isn't a turbine controller; it's the database utilities use to track what hardware they own and when it needs maintenance. That makes this less dramatic than a grid-control bug, but it's a clean example of software shipping with test-only tools left reachable in production - and because it's energy infrastructure, the stakes sit a notch above a typical web app flaw. Hitachi Energy's actual fix, version 9.9.1, isn't out yet, so the advice for now is simply to turn the affected servlets off.\n\nFile it next to the long list of ICS advisories where the vulnerability wasn't clever code, but a debug switch nobody remembered to lock.","[\"ics-security\",\"critical-infrastructure\",\"vulnerability\",\"energy-sector\"]","2026-10-06T12:00:00.000Z","2026-10-07T01:04:41.524Z","2026-10-07T01:04:45.746Z","published",null,[],"security",[26,27,28,29],"ics-security","critical-infrastructure","vulnerability","energy-sector",[31],{"name":32,"url":33},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-279-03",0,{"sections":36},[37,42,46,51,56,61,66,71,76,81,86,91,95,100],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",6357,"2026-10-06T17:28:33.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",892,"2026-10-06T17:50:11.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",468,"2026-10-06T17:01:52.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",406,"2026-10-06T18:26:53.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",216,"2026-10-06T18:22:57.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Science","science",184,"2026-10-06T18:10:45.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Consumer Tech","consumer-tech",165,"2026-10-06T17:31:59.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Software","software",109,"2026-10-06T17:06:24.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Startups","startups",105,"2026-10-06T16:29:12.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",103,"2026-10-06T17:20:00.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Gaming","gaming",55,"2026-10-06T09:38:03.000Z",{"name":92,"slug":93,"count":89,"latest_published_at":94},"General","general","2026-10-06T13:57:32.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",33,"2026-10-05T11:57:17.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]