Could this breach have been prevented?

Timely patching, restricting external custom reports, network segmentation, and continuous anomaly detection could have minimized the risk or impact of this exploitation.

What makes deserialization vulnerabilities dangerous in critical infrastructure software?

Deserialization flaws can allow attackers to execute code undetected within operational networks, potentially disrupting essential services or exfiltrating sensitive data.

Critical RCE Flaw in Hitachi Energy Asset Suite: Jasper Report Vulnerability Exposes Critical Infrastructure (2025)

A remotely exploitable deserialization vulnerability in Hitachi Energy Asset Suite (CVE-2025-10492) has put energy sector operations worldwide at heightened risk. Learn what happened, the compliance impact, and how enterprises should respond.

Published: January 11, 2026

Share this on:

Executive Summary

In December 2025, Hitachi Energy disclosed a critical remote code execution (RCE) vulnerability (CVE-2025-10492) affecting its Asset Suite product versions 9.7 and prior. The flaw, found in the Jasper Report third-party component, arises from improper deserialization of untrusted data, allowing attackers to remotely execute arbitrary code on affected systems. The vulnerability particularly impacts organizations using Asset Suite in critical infrastructure sectors, such as energy, potentially exposing operational networks to severe risks of compromise, data breach, or service disruption.

This incident underscores the persistent threat posed by supply chain vulnerabilities in industrial control software. As threat actors increasingly target critical infrastructure through third-party and open-source components, organizations face heightened regulatory scrutiny and an urgent need for robust patch and mitigation strategies to close compliance and security gaps.

Why This Matters Now

The exposure of a critical deserialization vulnerability in widely deployed energy sector software highlights ongoing risks from third-party components. The urgency is amplified by increasing attacker focus on operational technology and stricter regulatory expectations around timely patching and segmentation. Organizations must act quickly to remediate, update, and secure east-west traffic in hybrid industrial environments.

Attack Path Analysis

Attackers exploited a deserialization vulnerability (CVE-2025-10492) in the Hitachi Energy Asset Suite via an accessible network interface, resulting in remote code execution. They leveraged this access to escalate privileges within the application or underlying server. The adversaries then moved laterally to other internal systems, potentially pivoting between workloads. Command and control was established through outbound network connections, allowing remote control and download of tools. Data was subsequently exfiltrated via unmonitored or insufficiently restricted egress channels, followed by impactful actions such as data corruption, ransomware deployment, or operational disruption.

Kill Chain Progression

Initial Compromise

High

Privilege Escalation

Medium

Lateral Movement

Medium

Command & Control

Medium

Exfiltration

Medium

Impact

Lowinferred

Initial Compromise

Description

Attackers exploited the Java deserialization vulnerability (CVE-2025-10492) in exposed Jasper Report components to achieve remote code execution on the Asset Suite server.

Confidence:

High

Related CVEs

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2025-10492
CVSS 9.8
A Java deserialization vulnerability in the Jasper Report component of Hitachi Energy Asset Suite allows remote code execution.
Affected Products:
Hitachi Energy Asset Suite – 9.7 and prior
Exploit Status:
no public exploit
References:
https://www.cisa.gov/news-events/ics-advisories/icsa-26-008-01
CVE-2025-2500
CVSS 7.4
A vulnerability in the SOAP Web services of Hitachi Energy Asset Suite allows unauthorized access and extends the window for password attacks.
Affected Products:
Hitachi Energy Asset Suite – 9.6.4.4, 9.7
Exploit Status:
no public exploit
References:
https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-01
CVE-2025-1484
CVSS 6.5
An incomplete list of disallowed inputs in the media upload component of Hitachi Energy Asset Suite allows JavaScript execution in the user's browser.
Affected Products:
Hitachi Energy Asset Suite – 9.6.4.4
Exploit Status:
no public exploit
References:
https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-01

MITRE ATT&CK® Techniques

Initial Access

T1190

Exploit Public-Facing Application

Execution

T1059.002

Command and Scripting Interpreter: JavaScript/JScript

Exfiltration

T1048.002

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Defense Evasion

T1055

Process Injection

Privilege Escalation

T1548

Abuse Elevation Control Mechanism

Defense Evasion

T1211

Exploitation for Defense Evasion

Persistence

T1078

Valid Accounts

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Security of System Components and Software

Control ID: 6.2.4

Failure to apply timely software updates allowing RCE via deserialization vulnerability demonstrates inadequate patch management and vulnerability remediation.

NYDFS 23 NYCRR 500 – Cybersecurity Policy

Control ID: 500.03

Lack of controls to restrict the use of insecure third-party components and absence of proper access segmentation exposes the environment to unauthorized remote code execution.

DORA – ICT Risk Management Requirements

Control ID: Article 9

The presence of critical software vulnerabilities with known exploits indicates insufficient ICT risk management and software lifecycle governance under DORA.

CISA Zero Trust Maturity Model (ZTMM) 2.0 – Use secure software development practices

Control ID: Application and Workload Pillar – Application Security

Exploitation of insecure deserialization in a third-party library highlights weaknesses in application security controls and software supply chain risk management.

NIS2 Directive – Incident Prevention and Detection

Control ID: Article 21 (Paragraph 2 e)

Failure to prevent exploitation of a public-facing application used in critical energy infrastructure suggests insufficient preventive security and monitoring measures as required under NIS2.

NIST SP 800-53 Rev. 5 – Flaw Remediation

Control ID: SI-2

Delayed remediation of critical vulnerabilities undermines organizational ability to address known flaws as soon as reasonable, violating standard best practices.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Utilities

Critical energy infrastructure faces severe remote code execution vulnerability in Hitachi Energy Asset Suite affecting power grid management and operational control systems.

Oil/Energy/Solar/Greentech

Energy sector operations vulnerable to deserialization attacks through Asset Suite systems, requiring immediate patching to prevent unauthorized industrial control system access.

Industrial Automation

Manufacturing control systems using Hitachi Energy Asset Suite exposed to critical remote code execution exploits compromising production safety and operational integrity.

Government Administration

Public sector energy management infrastructure at risk from CVSS 9.8 vulnerability requiring coordinated response and defensive measures per CISA recommendations.

Sources

Hitachi Energy Asset Suitehttps://www.cisa.gov/news-events/ics-advisories/icsa-26-008-01
Verified

Hitachi Energy Asset Suite Advisory ICSA-25-196-01https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-01

Verified

Hitachi Energy Asset Suite Advisory ICSA-25-261-04https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-04

Verified

Frequently Asked Questions

The incident revealed weaknesses in supply chain security, patch management, and data transport encryption, highlighting the need for robust controls per NIST, PCI, and sector-specific frameworks.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Zero Trust controls such as segmentation, east-west traffic enforcement, and egress filtering would have limited attacker movement and reduced the blast radius. CNSF capabilities provide workload isolation, restrict lateral movement, and detect anomalous activity, mitigating the success and impact of such vulnerability exploitation in industrial environments.

Initial Compromise

Control: Cloud Firewall (ACF)

Mitigation: Ingress attack surface reduced via explicit firewall policy.

Privilege Escalation

Control: Threat Detection & Anomaly Response

Mitigation: Rapid detection of privilege escalation attempts.

Lateral Movement

Control: Zero Trust Segmentation

Mitigation: Lateral movement blocked by microsegmentation boundaries.

Command & Control

Control: Egress Security & Policy Enforcement

Mitigation: Malicious external connections prevented or flagged.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Data exfiltration attempts identified and stopped.

Impact (Mitigations)

Rapid alerting on destructive or anomalous behavior minimizes impact.

Impact at a Glance

Affected Business Functions

Asset Management
Maintenance Scheduling

Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: $500,000

Data Exposure

Potential exposure of sensitive asset and maintenance data due to unauthorized access.

Recommended Actions

• Immediately apply vendor patches to remediate CVE-2025-10492 and restrict access to vulnerable components.
• Implement Zero Trust Segmentation to minimize lateral movement risks and limit attacker blast radius.
• Enforce granular cloud firewall and egress policies to restrict unauthorized inbound and outbound connectivity.
• Enable continuous anomaly and threat detection to identify privilege escalation and other attack behaviors in real time.
• Regularly review network and workload policies for least privilege, strong segmentation, and comprehensive east-west inspection.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

Critical RCE Flaw in Hitachi Energy Asset Suite: Jasper Report Vulnerability Exposes Critical Infrastructure (2025)

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

Related CVEs

CVE-2025-10492

Affected Products:

Exploit Status:

References:

CVE-2025-2500

Affected Products:

Exploit Status:

References:

CVE-2025-1484

Affected Products:

Exploit Status:

References:

MITRE ATT&CK® Techniques

Exploit Public-Facing Application

Command and Scripting Interpreter: JavaScript/JScript

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Process Injection

Abuse Elevation Control Mechanism

Exploitation for Defense Evasion

Valid Accounts

Potential Compliance Exposure

PCI DSS 4.0 – Security of System Components and Software

NYDFS 23 NYCRR 500 – Cybersecurity Policy

DORA – ICT Risk Management Requirements

CISA Zero Trust Maturity Model (ZTMM) 2.0 – Use secure software development practices

NIS2 Directive – Incident Prevention and Detection

NIST SP 800-53 Rev. 5 – Flaw Remediation

Sector Implications

Utilities

Oil/Energy/Solar/Greentech

Industrial Automation

Government Administration

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads