CVE-2024-2011 is a high severity (CVSS 8.6) heap based buffer overflow in Hitachi Energy FOXMAN-UN and UNEM. It usually leads to denial of service but can be used to execute arbitrary code. Read the Hitachi Energy advisory for fixed releases and apply them.
What's affected
The NVD record names Hitachi Energy FOXMAN-UN and UNEM, with releases R15A, R15B PC4 and R16A in its product list. The record's references are two Hitachi Energy advisory documents, but the advisory site is a script driven page that returned no readable text for me, so I could not confirm fixed versions, affected ranges beyond that list, or mitigations. Treat the version list as incomplete and read the advisory on the Hitachi Energy site.
NVD rates it 8.6 (High), with a network vector and no privileges. The advisory could not be read. NVD scores it 8.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.
How to check if you're exposed
FOXMAN-UN is a network management system, and UNEM is its related server product. Look for them in your asset inventory and read the release from the product's about or version page. Compare with the releases the record names, and read the Hitachi Energy advisory for the exact affected ranges and the fix.
Then check exposure. Management servers and their API gateways belong on a segregated management network. If the API gateway is reachable from user networks or the internet, treat that as the first thing to correct.
What to do now
- Find all FOXMAN-UN and UNEM servers and note their release.
- Read the Hitachi Energy advisory documents named in the record for fixed versions and mitigations.
- Apply the vendor's update or its stated workaround.
- Restrict network access to the server and its API gateway to management hosts only.
- Review server and gateway logs for connections from unexpected addresses.
Why it matters
The record lists CWE-122 (heap based buffer overflow) and CWE-787 (out of bounds write). The program writes past the end of a heap buffer, corrupting memory. The description says it will generally cause denial of service, but can be used to execute arbitrary code.
The CVSS availability impact is high and confidentiality and integrity are low, which fits that statement. A crash of a network management server means operators lose visibility of the network, so even the denial of service outcome matters. Combine the patching with the same network restrictions as the other two FOXMAN-UN CVEs. The KEV flag is false. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
Can it run code?
The description says it generally causes denial of service but can be used to execute code, which is usually outside a program's security policy.
Is a fix confirmed?
Not in the record. Read the Hitachi Energy advisory.
Sources
Last reviewed: 19 October 2026.
