CISA published a security advisory on October 6, 2025, regarding unauthenticated servlet access vulnerabilities in Hitachi Energy Asset Suite version 9.9.0 and above. The vulnerabilities are classified as an ICS advisory with a CVSS score of 8.1 and can affect the confidentiality, integrity, and availability of the product. Affected systems are primarily in the energy sector, with global deployment.
What happened in detail
Hitachi Energy confirmed that Asset Suite, used for industrial asset management, is exposed to unauthenticated access through servlets. This means an attacker can access certain functionality in the system without needing to authenticate. The vulnerability affects versions 9.9.0 and above and is classified as an industrial control systems issue.
The CVSS score of 8.1 places the vulnerability in the high severity category. Potential impact includes compromise of data confidentiality, data modification, and disruption of system availability. These are systems deployed primarily in the energy sector worldwide.
Why it matters beyond the headline
Unauthenticated access vulnerabilities are exactly the kind of issue that is easy to miss during development. The system works, tests pass, and functionality is correct. The problem is that an endpoint intended for internal or authenticated use remains exposed.
In systems built under banking or regulatory security standards, every servlet, API endpoint, or exposed function must undergo explicit authentication checks. It is not enough for the system to “usually” require login. Every access point must enforce authentication explicitly, even if it appears internal.
The fact that this occurs in a Hitachi Energy system, a large company with security teams, demonstrates that this is not a matter of lack of knowledge but of testing processes. Industrial systems and critical infrastructure require focused security reviews, not just functional testing.
What to do this week
If you are building a system that connects to industrial, healthcare, or financial infrastructure, spend an hour reviewing endpoints. Go through every servlet, controller, or API route and verify there is explicit authentication checking at the function entry point, not just at the routing level.
In banking systems, regulators expect to see that every access point has undergone documented security testing. It is not enough to rely on general middleware. Every function that handles sensitive data must enforce permissions explicitly.
If you are working with an external vendor, ask how they test for unauthenticated access in their security review. This is a legitimate question that any serious vendor can answer. For more information on building systems under security standards, see custom AI systems for organisations.
Sources
- Hitachi Energy Asset Suite · CISA
Frequently asked questions
How do you test for unauthenticated access vulnerabilities in an existing system?
Run an automated security scan that tests every endpoint without authentication, and manually review every servlet or API route to verify there is explicit permission checking at the function entry point. Regular functional tests do not catch this because they run the system with an authenticated user.
What is the difference between unauthenticated access and authorization vulnerabilities?
Unauthenticated access means you can reach a function without logging in at all. Authorization vulnerabilities mean an authenticated user can do things they should not. The second is dangerous, the first is critical because it exposes the system to anyone.