CVE-2024-2013 is a critical severity (CVSS 10.0) authentication bypass in the server and API gateway of Hitachi Energy FOXMAN-UN and UNEM. Attackers with no access can reach services and the attack surface behind login. Read the Hitachi Energy advisory for fixes and restrict access now.
What's affected
The NVD record names Hitachi Energy FOXMAN-UN and UNEM, with releases R15A, R15B PC4 and R16A in its product list. The record's references are two Hitachi Energy advisory documents, but the advisory site is a script driven page that returned no readable text for me, so I could not confirm fixed versions, affected ranges beyond that list, or mitigations. Treat the version list as incomplete and read the advisory on the Hitachi Energy site.
Severity here is the top of the scale. The advisory itself could not be read, so the score is NVD's. NVD scores it 10.0 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
How to check if you're exposed
FOXMAN-UN is a network management system, and UNEM is its related server product. Look for them in your asset inventory and read the release from the product's about or version page. Compare with the releases the record names, and read the Hitachi Energy advisory for the exact affected ranges and the fix.
Then check exposure. Management servers and their API gateways belong on a segregated management network. If the API gateway is reachable from user networks or the internet, treat that as the first thing to correct.
What to do now
- Find all FOXMAN-UN and UNEM servers and note their release.
- Read the Hitachi Energy advisory documents named in the record for fixed versions and mitigations.
- Apply the vendor's update or its stated workaround.
- Restrict network access to the server and its API gateway to management hosts only.
- Review server and gateway logs for connections from unexpected addresses.
Why it matters
The record lists CWE-288 (authentication bypass using an alternate path or channel) and CWE-306 (missing authentication for a critical function). In plain terms, a path into the service does not check who is calling.
The description says attackers without any access can interact with the services and the post authentication attack surface. That is the real danger. Most defenses assume code behind a login is only reached by trusted users, and an authentication bypass hands that whole surface to anyone who can reach the gateway. It also chains with the other two FOXMAN-UN flaws published the same day, CVE-2024-2011 and CVE-2024-2012. CVSS 10.0 reflects network access, no privileges and a changed scope. The KEV flag is false. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
Why is the score 10.0?
The vector is network reachable, low complexity, no privileges, no user interaction and a changed scope with high impact on confidentiality, integrity and availability.
Is there a fix?
The record points to Hitachi Energy advisory documents. Read them for fixed releases.
Sources
Last reviewed: 19 October 2026.
