Critical Hitachi Energy ICS Vulnerability CVE-2025-1718: Risks and Mitigation Strategies for the Energy Sector

As industrial control systems (ICS) continue to evolve and the digital backbone of critical infrastructure grows more complex, securing devices at every layer remains a top priority for both operators and manufacturers. The recent vulnerability disclosure impacting Hitachi Energy’s Relion 670/650 and SAM600-IO series highlights the persistent challenges faced by the energy sector—a field where reliability is non-negotiable and the fallout from cybersecurity lapses can ripple across nations. This in-depth analysis dissects the technical details, risk factors, mitigations, and broader implications surrounding CVE-2025-1718, while evaluating the response of both Hitachi Energy and the wider ICS security community.

Understanding the Vulnerability: Improper Check for Unusual or Exceptional Conditions​

Overview of the Issue​

The disclosed vulnerability centers on an "Improper Check for Unusual or Exceptional Conditions," as classified under CWE-754. At its core, this flaw allows an authenticated user with file access privilege—gained via FTP logins—to trigger a device reboot by exploiting improper disk space management within the affected products. The flaw does not require elevated privileges, only basic file access, and can be orchestrated remotely under certain circumstances. This vulnerability is tracked as CVE-2025-1718 and, importantly, can only be exploited by users who have already passed authentication checks, meaning a successful attack would generally require prior compromise of credentials or access provisioning.

Technical Scope and Impacted Products​

According to the official ICS advisory and Hitachi Energy’s own notifications, the vulnerability spans multiple firmware versions across both the Relion 650 and 670 protection relays, as well as the SAM600-IO series. The depth and breadth across product lines underscore a systemic root cause in disk management routines—and signify the potential for widespread operational impact if left unaddressed.

Affected product versions include:​

• Relion 650: Version 1.0.0 up to (but not including) 2.0.0; several 2.1.0–2.2.6 variants up to 2.2.6.3
• Relion 670: Version 1.0.0 up to 2.0.0, then up through 2.2.6.3
• SAM600-IO: Versions from 2.2.1.0 up to 2.2.1.6, and again from 2.2.5.0 up to 2.2.5.7

This means that organizations operating fleets of these devices—ubiquitous in modern substations and grid automation platforms—must carry out careful inventory and patch management. It is imperative for asset owners to verify which devices in their networks harbor the vulnerable firmware before attackers have an opportunity to exploit unattended exposures.

CVSS Scoring and Exploitability​

Initial CVSS v3.1 scoring places the vulnerability at a base 6.5 (Medium), but the adoption of CVSS v4—designed to better reflect modern cyber-physical threats—elevates this to a base 7.1 (High). The attack complexity remains low, requiring no user interaction and minimal conditions: the only hurdle is authenticated FTP file access, a capability that is often used for configuration, event file retrieval, or firmware updates in these systems.
The scoring vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) reflects:

• Attack Vector (AV:N): Network-based, meaning remote exploitation is possible if the device is exposed.
• Privileges Required (PR:L): Low; authenticated, but not necessarily privileged, users.
• Availability Impact (VA:H): High—successful exploitation causes device reboot, producing denial-of-service (DoS).

Notably, there is, as of publication, no evidence of active exploitation in the wild according to both Hitachi Energy and CISA. However, history has shown that even proprietary ICS protocols and secured management ports can become targets following public disclosure if patches are not swiftly applied.

Critical Infrastructure at Risk: Why This Matters​

The Role of Relion and SAM600-IO in Modern Energy​

Relion protection relays are central to Hitachi Energy’s portfolio for substation automation. They provide vital protection, control, and measurement functions to digital substations—a key enabler of the smart grid. The SAM600-IO modules operate as intelligent interface units, connecting analog signals to the digital relay protection and automation system. Both components are widely deployed in the energy sector across continents, underpinning power distribution reliability in environments where downtime is not just inconvenient but often catastrophic.
A forced reboot resulting from a remote attack—even if not leading to file corruption or permanent damage—can de-energize a section of a grid, temporarily remove protection functions, or trigger cascading failsafes. This is particularly acute for energy providers, transmission grid operators, and critical manufacturing operations relying on uninterrupted protection relays.

Attack Vector and Real-World Risks​

Features such as FTP access, though ostensibly secure with authentication barriers, are often exposed within operational technology (OT) networks to enable rapid remote maintenance and file transfers during incident response. FTP credentials can be compromised through phishing, credential stuffing, or weak password policies, raising the practical risk of the vulnerability. While the exploit does not directly allow code execution or data theft, the availability impact is significant:

• Device Reboots: Even brief interruptions can trigger protective tripping, loss of monitoring, or fail-safe states.
• Denial-of-Service Chains: Multiple devices could be targeted in quick succession, increasing the blast radius.
• Potential OPAQUE Risk: If relays are leveraged as a pivot point or distraction during multi-stage cyber-physical attacks.

Furthermore, as digital substations become increasingly interconnected and remotely managed, the theoretical barrier between IT and OT is thinning—opening ICS to a wider spectrum of threat actors, from nation-states to ransomware groups.

Vendor and Community Response​

Hitachi Energy’s Transparency and Patch Management​

One of the strengths of this disclosure is Hitachi Energy’s proactive engagement with both the Cybersecurity and Infrastructure Security Agency (CISA) and its customers. The company’s Product Security Incident Response Team (PSIRT) is credited with first reporting the vulnerability and publishing a thorough advisory (8DBD000174), outlining:

• Affected software versions with fine granularity
• Steps to update and mitigate risk, with specific firmware patch recommendations
• General best practices and network defense guidance

Patch Availability and Recommendations​

The vendor specifies that affected users should upgrade to:

• Relion 670 and 650 series: Version 2.2.6.4 or later
• SAM600-IO and others: Version 2.2.5.8 or later
• All series: Recommendation to upgrade to 2.2.7 where possible as the universal safest branch

Operators unable to immediately patch are advised to implement compensating controls, such as minimizing network exposure, hardening authentication policies, and monitoring for unusual device reboots indicative of attempted exploitation.

Industry Mitigation Guidance​

CISA extends the guidance, reminding organizations to:

• Remove control systems from direct Internet access
• Place ICS devices behind firewalls, segmenting them from the business network
• Use secure remote access methods (like VPN, albeit recognizing VPNs have their own risks)
• Monitor ICS/SCADA network activity for suspicious connections and failed login attempts

Documents such as CISA Defense-in-Depth Strategies and targeted ICS-TIP-12-146-01B provide authoritative frameworks for ICS cyber defense.

Critical Analysis: Strengths, Weaknesses, and Strategic Gaps​

Strengths​

• Proactive Vendor Disclosure: Hitachi Energy responded with transparency and granularity, allowing asset owners to quickly identify affected deployments and begin patch planning.
• Granular Firmware Guidance: Specific affected ranges and recommended versions enable targeted remediation, reducing both over-patching risk and under-protection.
• No Public Exploitation (Yet): No evidence of this bug being exploited in the wild buys organizations precious time to patch or compensate before attackers catch up.

Weaknesses and Ongoing Risks​

• Dependency on FTP: Continued use of legacy protocols like FTP, which often lack strong encryption or sophisticated access controls compared to SFTP/SSH, expands the threat surface—even for users with authentication.
• Patch Lag in Critical Infrastructure: Real-world deployment of firmware updates in substations is fraught with risk, requiring site visits, outage windows, and, in some cases, regulatory approval. This ‘patch lag’ leaves a window of exposure—potentially measured in months, not days.
• Remote Access in Legacy ICS: Many substations were designed for physical security—a paradigm increasingly challenged by modern threats and remote administrative requirements. Segmentation and isolation may not always be feasible due to business process constraints.
• Potential for Insider/Third-Party Risk: Because the exploit requires authenticated access, the threat is higher from rogue insiders, compromised maintenance vendor accounts, or inadequately protected engineering workstations.

Strategic Recommendations​

To further fortify OT environments in this context, organizations should consider:

• Zero Trust Principles: Move toward granting only the least privilege required for operational tasks and monitor all device access, especially from remote locations or third parties.
• Credential Hygiene: Ensure robust password policies and consider multi-factor authentication for all device access, including FTP or its secure successors.
• File Transfer Segmentation: Transition from FTP to SFTP/SSH where technically feasible, and restrict file transfer capability to maintenance windows or dedicated jump hosts within a management enclave.
• Continuous Monitoring: Implement anomaly detection and event logging tied to device reboots, failed logins, and unusual file transfer activity.

Implications for Digital Substations and the Energy Sector​

Broader Threat Implications​

With digital substations and process automation taking center stage in the drive towards a smart grid, the attack surface grows—in both quantity and interconnectedness. This vulnerability, while not novel in technique, is a stark reminder that ICS/SCADA device firmware remains a fertile frontier for attackers. Vendors and asset owners must continue collaborative disclosure, rapid patching, and layered defense to safeguard critical energy delivery.

Future Outlook​

Given the expanding use of OT/IT convergence, energy providers should expect continued scrutiny on embedded device security—especially around protocols like FTP, SNMP, and older management consoles. Strategic investment in threat hunting, staff training, and post-patch validation will be critical to minimizing operational disruptions from new vulnerabilities.
A noteworthy concern is supply chain diversity: with so many versions simultaneously supported in the field, even a single vendor patch does not guarantee all deployments will be equally protected due to variant hardware, regulatory approval hurdles, or integrator complexities. Automation of asset management and vulnerability scanning within substations will become a best practice—if not a requirement—for forward-thinking utility providers.

Conclusion: The High Stakes of “Minor” Bugs in Major Infrastructure​

In conclusion, CVE-2025-1718 is emblematic of the evolving fault lines within industrial control system security: legacy protocols, operational constraints, and ever-evolving attack tactics collide in ways that demand agility from both technology providers and infrastructure operators. The vulnerability in Hitachi Energy’s Relion 670/650 and SAM600-IO series is not, on the face of it, a catastrophic remote code execution. But the real risk is realized when an operationally critical device is forced offline at a pivotal moment—potentially affecting grid reliability, safety, or even national security.
For now, the energy sector has the information—and, crucially, the window—to remediate before opportunistic cyber attackers shift their gaze toward this newly revealed opening. The effective combination of robust patch management, hardening of network and user access, proactive monitoring, and multi-layered defense-in-depth strategies will ensure not only compliance with regulatory best practices but also the continued safety, security, and resilience of the grids that power our modern world.

---

Source: CISA Hitachi Energy Relion 670/650 and SAM600-IO Series | CISA