Authentication Vulnerability in Equipment Tag Out for Hitachi Energy Products

CVE-2023-4816

What is CVE-2023-4816?

A security flaw exists in the Equipment Tag Out feature of Hitachi Energy products, particularly when utilizing Single Sign-On (SSO) with password validation. This vulnerability allows an authenticated user to perform holder actions (such as Accept, Release, and Clear) on behalf of another user by inputting an arbitrary password in the confirmation dialog box. As a result, the system processes the selected action without properly validating the password, potentially leading to unauthorized operations.

References