CVE-2024-2012: Critical Command Execution in FOXMAN-UN API

CVE-2024-2012 is a critical severity (CVSS 9.1) flaw in the server and API gateway of Hitachi Energy FOXMAN-UN and UNEM. An attacker could run unintended commands or code on the server and read or change sensitive data. Read the Hitachi Energy advisory for the fix.

What's affected

The NVD record names Hitachi Energy FOXMAN-UN and UNEM, with releases R15A, R15B PC4 and R16A in its product list. The record's references are two Hitachi Energy advisory documents, but the advisory site is a script driven page that returned no readable text for me, so I could not confirm fixed versions, affected ranges beyond that list, or mitigations. Treat the version list as incomplete and read the advisory on the Hitachi Energy site.

NVD rates it 9.1 (Critical), and the vector shows high privileges required, so the attacker needs a privileged position first. The advisory could not be read. NVD scores it 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

How to check if you're exposed

FOXMAN-UN is a network management system, and UNEM is its related server product. Look for them in your asset inventory and read the release from the product's about or version page. Compare with the releases the record names, and read the Hitachi Energy advisory for the exact affected ranges and the fix.

Then check exposure. Management servers and their API gateways belong on a segregated management network. If the API gateway is reachable from user networks or the internet, treat that as the first thing to correct.

What to do now

1. Find all FOXMAN-UN and UNEM servers and note their release.
2. Read the Hitachi Energy advisory documents named in the record for fixed versions and mitigations.
3. Apply the vendor's update or its stated workaround.
4. Restrict network access to the server and its API gateway to management hosts only.
5. Review server and gateway logs for connections from unexpected addresses.

Why it matters

NVD tags this CWE-288, authentication bypass using an alternate path or channel. The description says an attacker could use it to cause unintended commands or code to run on the UNEM server, allowing sensitive data to be read or modified.

The PR:H in the vector suggests the attacker needs a high privilege, yet the scope change and the sibling CVE-2024-2013 authentication bypass in the same gateway mean you should not lean on that. Assess the three FOXMAN-UN CVEs from this date as one exposure and patch together. The KEV flag is false. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.

Quick check

Sources

• Hitachi Energy advisory 8DBD000201 (listed in the NVD record, not readable when retrieved)

Last reviewed: 19 October 2026.