Hitachi Energy PROMOD V

Summary

A high-severity vulnerability has been identified in Hitachi Energy's PROMOD V software. The flaw stems from the use of insecure HTTP communication instead of the encrypted HTTPS protocol. This issue originates from a lack of HTTPS support within the third-party Digipede server used by the product.

The vulnerability, tracked as CVE-2026-10763, carries a CVSS score of 7.0. Because the communication occurs over unencrypted channels, an attacker with network access could potentially intercept or modify data transmitted between the PROMOD V system and its Digipede server components.

Technical details

The core of the issue lies in the transport layer used for data exchange. While modern security standards mandate encrypted protocols like HTTPS to ensure confidentiality and integrity, PROMOD V relies on standard HTTP.

This lack of encryption is attributed to the third-party Digipede server integrated into the workflow. Without the implementation of HTTPS, all transmitted information remains in plaintext, making it susceptible to various network-based interception techniques.

Why this matters for defenders

In industrial environments, unencrypted communication channels represent a significant blind spot. If an actor gains access to the local network or the segment where these communications occur, they can observe sensitive data flows without needing to bypass encryption layers.

The risk is not merely about reading data but also about the potential for man-in-the-middle interference. Since the protocol lacks the cryptographic verification provided by HTTPS, there is no inherent way for the system to verify that the data received has not been altered in transit.

Defender guidance

Immediate network segmentation is the primary method to reduce exposure. Isolate PROMOD V and its associated Digipede server traffic within a dedicated, highly controlled VLAN to limit the number of potential listeners on the network.

Monitor network traffic specifically for HTTP requests originating from or directed toward the Digipede server components. Any unexpected or unauthorized communication attempts in these segments should be treated as high-priority alerts.

Review your architecture to determine if alternative secure communication paths can be established, though current documentation indicates the limitation resides with the third-party server's lack of HTTPS support.