Hitachi Energy has acknowledged a critical Java deserialization flaw tied to the Jaspersoft reporting library that affects multiple releases of Asset Suite, creating a realistic path to remote code execution (RCE) for unpatched deployments; immediate action is required for any organization running Asset Suite 9.7 or earlier, and operators should treat this as a high-priority industrial control systems (ICS) security emergency until the vendor’s fixes are applied.
Background / Overview
Asset Suite is Hitachi Energy’s enterprise asset management (EAM) product used widely in energy and mission-critical industrial environments. The product integrates multiple open-source components — a common approach that accelerates development but expands the dependency surface for security issues. In mid‑September 2025 a serialization/deserialization vulnerability in the Jaspersoft/JasperReports library was assigned CVE‑2025‑10492; vendors and national CERTs subsequently mapped the issue to Hitachi Energy’s Asset Suite builds and coordinated advisory and mitigation guidance. Independent vulnerability databases (NVD, Tenable) and Jaspersoft’s own advisories describe the underlying weakness as a
JasperReports deserialization flaw that can be triggered by untrusted, specially crafted report data and lead to arbitrary code execution. This article walks operators through the technical mechanics of the flaw, who and which versions are affected, the vendor-prescribed remediation and practical mitigations for energy/OT environments, and the operational checklist to reduce risk while you patch.
The technical problem: Java deserialization in JasperReports
What “deserialization of untrusted data” means in practice
Deserialization vulnerabilities arise when software reconstructs object graphs from serialized data without sufficient validation. In Java ecosystems, this commonly occurs when libraries call ObjectInputStream (or similar mechanisms) on data that could be controlled by an attacker. If the classpath includes gadget classes that perform sensitive actions during deserialization, an attacker can craft a payload that executes code as the process user during the deserialization step. The weakness is cataloged as
CWE‑502: Deserialization of Untrusted Data.
Why Jaspersoft matters for Asset Suite
Asset Suite uses JasperReports to generate and render custom reports. Customer or administrative inputs that cause the application to load report templates or serialized report objects can present an attack surface if those inputs are processed by the vulnerable JasperReports library version. Since report processing frequently runs inside the application server process (often with elevated privileges inside the application context), successful exploitation can escalate into full application compromise, file system access, or launching arbitrary processes — classic RCE outcomes. Multiple public vulnerability trackers list Jaspersoft library versions as vulnerable and detail proof-of-concept payload constructs for the general class of Jaspersoft deserialization bugs; the CVSS v3.1 base for CVE‑2025‑10492 is 9.8 (critical), reflecting the strong real-world impact of an unauthenticated remote attack.
Attack vectors and realistic prerequisites
- Network exposure: The vulnerability is exploitable over the network when a vulnerable report-processing endpoint accepts unvalidated data. In Asset Suite deployments where the admin or reporting interfaces are reachable from engineering subnets — or worse, the Internet — risk is acute.
- User-supplied reports: Many deployments permit end users to upload custom Jasper report templates; untrusted templates are a common exploitation vector.
- Privilege considerations: The exploit runs in the context of the application process. If that process has access to system resources, the attacker inherits those privileges. Typical ICS deployment patterns (centralized servers, integration with OT management systems) significantly increase the blast radius.
Because these scenarios reflect normal operational behavior in many Asset Suite installations, defenders must assume the vulnerability can be reliably weaponized in poorly hardened or exposed environments.
Affected products and vendor guidance (what to patch)
Versions reported as affected
- Hitachi Energy Asset Suite versions up to and including 9.7 have been reported as affected; vendor coordination with national agencies identifies multiple Asset Suite builds that embed vulnerable third‑party components. Several advisories list Asset Suite 9.x series components (9.6.x, 9.7, and earlier) as requiring remediation.
Vendor remediation and upgrade path
- Hitachi Energy’s public coordination with CISA and the PSIRT indicates that the vendor’s remedial path for multiple open-source component issues in Asset Suite includes moving affected installations to fixed product builds — in practical terms the vendor has recommended updating to the 9.8 series (or the specific fixed build referenced in the PSIRT bulletin) where available. Administrators should treat the vendor’s fixed release as authoritative for exact build numbers and upgrade procedures.
Cross-checks from independent sources
- NVD, Tenable, and other vulnerability databases list CVE‑2025‑10492 as a Jaspersoft library flaw with a strong exploitability profile; Jaspersoft’s own advisory and public trackers enumerate the vulnerable library versions and recommend updating to the patched JasperReports releases. That means two independent axes of verification exist: (1) the Jaspersoft vendor advisory describing the library fix and (2) Hitachi Energy’s advisory or PSIRT that maps the library risk into the Asset Suite product and specifies the upgrade requirement.
Immediate actions — pragmatic, prioritized checklist
Apply the following actions in the order given. Label each step in your change control and track verification.
- Inventory and exposure mapping (first 2–4 hours)
- Identify every Asset Suite instance (hostname, management IP, version string, and report endpoints). Record which instances allow custom report uploads or remote report rendering.
- Confirm whether any Asset Suite management interfaces are reachable from non‑trusted networks (engineering VLANs, Internet, vendor networks).
- Isolate and reduce exposure (same day)
- Block external access to Asset Suite administration/reporting endpoints at the perimeter and internal firewalls. If remote access is required, enforce connection via a hardened, monitored jump host or VPN with strict allow‑lists. CISA has repeatedly called out minimizing network exposure as a primary mitigation for ICS vulnerabilities.
- Disable untrusted report loading (same day)
- Temporarily disable the ability for end users to upload or import custom Jasper reports unless they come from a verified, offline-validated source. Replace with administrator-only report publishing workflow until you can apply the patch. This is an effective short-term compensating control recognized by the vendor advisory.
- Obtain and validate vendor fixes (24–72 hours)
- Contact Hitachi Energy support or your service provider channel and retrieve the PSIRT advisory and the exact fix build(s) for your Asset Suite variant. Treat the vendor PSIRT bulletin as the authoritative upgrade path and follow its published steps for safe upgrade and rollback.
- Patch and test (72 hours to scheduled window)
- Apply the vendor-provided upgrade (for many environments: move to Asset Suite 9.8 or the specific fixed release identified). Test in a staging environment that mirrors production connectivity and integrations before full rollout. Validate:
- Report generation functions
- Authentication and SSO integrations
- Backup and restore across the upgrade
- Monitoring and alerting continuity
- Keep rollback procedures, backups, and support contacts ready.
- Post-patch validation and detection tuning (after patching)
- Verify no residual vulnerable JasperReports library files remain in custom plugin paths or user-uploaded template directories.
- Tune SIEM/EDR/IDS rules to flag anomalous report compile/load operations, suspicious classpath or process anomalies, and outgoing connections from the Asset Suite host.
- Longer-term remediation and hardening (weeks)
- Adopt allow‑list controls for report templates (only administrator-signed/verified templates may be loaded).
- Enforce strict separation of duties for report management and for platform administration.
- Reduce service privileges for the application process (run the app with minimal OS rights).
- Regularly scan product dependencies for known vulnerable third‑party libraries and integrate SBOM processes into procurement and patch consoles.
These steps combine the vendor-specified actions with recognized ICS best practices for minimizing real-world exploitation risk.
Detection, logging, and forensic considerations
- Enable and centralize logging for report import, compilation, and execution paths so you can correlate suspicious or unexpected report render requests. Note: some advisories point to prior log-manipulation issues in Asset Suite; this makes robust central logging and integrity checks even more critical.
- Monitor for process spawns and unusual system calls on Asset Suite hosts; successful Jaspersoft deserialization exploits typically produce unexpected JVM activity or child processes launched from the application server context.
- Capture OS-level and JVM heap dumps only in controlled conditions — they may contain sensitive secrets and must be handled as forensic evidence.
- If compromise is suspected, isolate the host immediately, preserve volatile logs, and engage incident response. Do not reintroduce the host to production before clean rebuild and patch.
Risk analysis: what’s at stake in energy/OT environments
- Operational integrity: Asset Suite often inventories and schedules maintenance for critical equipment; an attacker able to alter schedules or configurations could cause missed maintenance, incorrect configurations, or unsafe maintenance instructions.
- Lateral movement into OT: Compromise of an EAM server provides reconnaissance and pivot capability into SCADA/ICS realms, particularly where integrated workflows or connectors exist. ICS attack patterns consistently show attackers moving from administrative servers into control plane components.
- Regulatory and contractual exposure: Energy operators must meet regulatory requirements for operational resilience; a breach tied to unpatched asset management software can expose organizations to compliance violations and contractual damages.
- Safety and public risk: The ultimate severity is high in environments where system compromise could cascade to safety-critical equipment or grid services.
Because these consequences are non-trivial, prioritize Asset Suite upgrades as high-severity operational security work, not optional maintenance.
Vendor coordination and cross‑source verification
- Jaspersoft published an advisory describing CVE‑2025‑10492 and the patched library releases; NVD and other major vulnerability trackers list the CVE and provide scoring and affected library versions. These multiple independent sources confirm the technical root cause resides in the JasperReports deserialization code paths.
- Hitachi Energy PSIRT and allied national CERT/CISA advisories map the library-level issue into concrete product impact on Asset Suite and recommend specific upgrade paths (vendor fixed builds) and mitigations such as disabling untrusted report loading. Operators should treat Hitachi’s PSIRT advisories as the authoritative product-level source for upgrade steps and build IDs.
Cross-referencing the Jaspersoft advisory and Hitachi’s mapping is essential because the library fix alone (for example, upgrading JasperReports inside a custom-assembled product) may not be possible without an official vendor build that integrates the patched library and validates product-level behavior. That is why the vendor upgrade is the correct remediation route for most Asset Suite customers.
Practical gotchas and operational constraints
- EAM uptime and maintenance windows: Asset Suite is often mission‑critical; plan patch windows carefully and consider phased rollouts across global sites. A safe staging and rollback plan is essential.
- Custom integrations: If you have third‑party connectors or bespoke report plugins, verify compatibility with the vendor’s fixed build. Some custom templates may rely on older library behavior and will require retesting.
- End‑user workflows: Disabling custom report uploads affects business processes. Coordinate with operations to provide a temporary, secure path for producing required reports (administrator-curated templates only).
- Vendor support cadence: If your installation is EOL for a specific Asset Suite major release, vendor-supported remediation may require an upgrade of the entire product. Budget and timeline impacts must be planned for immediately.
If any claim about an available fixed build or a recommended version cannot be confirmed through Hitachi’s PSIRT or CISA mapping for your exact installed SKU, treat the claim as unverified and confirm directly with Hitachi support. Where public advisories differ on version numbers, rely on the vendor PSIRT advisory associated with your product’s DocumentID and build string.
Detection and indicators of compromise to watch for
- Unexpected JVM arguments or classloader activity tied to report classes.
- New or unusual files in application directories (uploaded report templates that were not created by administrators).
- Outbound network connections originating from Asset Suite hosts to IPs or domains not used in normal operations.
- Sudden spike in CPU or memory usage for the reporting threads — attempted deserialization payloads can trigger heavy computation or resource exhaustion.
- Unexplained creation of shell scripts or temporary binaries near application directories.
Tune SIEM rules to alert on these behaviors and escalate for forensic triage.
Conclusion — urgency, but pragmatic execution
This is a high‑urgency vulnerability: CVE‑2025‑10492 is a Jaspersoft deserialization issue with a critical exploit score and real-world applicability to Hitachi Energy’s Asset Suite product when vulnerable library versions are present. The vendor and national CERTs recommend upgrading to fixed Asset Suite builds (the 9.8 series and vendor‑specified releases where applicable) and immediately implementing compensating controls — most importantly restricting untrusted report upload and minimizing network exposure. Operators should treat this as an operational priority, coordinate scheduled upgrades with vendor support, and adopt the short-term mitigations listed above until every affected instance is patched. Stay disciplined: inventory, isolate, block custom report uploads, validate the vendor-supplied fixed build in a staging environment, and then patch production on a controlled schedule. That sequence balances
urgency with
operational safety — the correct posture for managing critical industrial software vulnerabilities.
Source: CISA
Hitachi Energy Asset Suite | CISA