Vulnerabilities
Hitachi Energy REB500: CVE‑2024‑8176 & CVE‑2025‑59375 Enable DoS via IEC61850
Hitachi Energy REB500 versions ≤8.3.3.1 suffer two libexpat flaws (CVE‑2024‑8176 and CVE‑2025‑59375) that can be leveraged by authenticated users to trigger a denial‑of‑service. The vendor has released a patch to 8.3.4.0; operators should update immediately and monitor IEC61850 traffic.
Hitachi Energy has identified two critical vulnerabilities in the REB500 energy management platform that can be exploited to cause a denial‑of‑service (DoS) condition. The flaws reside in the libexpat library used by the IEC61850 interface.
What happened
CVE‑2024‑8176 is a stack‑overflow triggered by a crafted IEC61850 message. CVE‑2025‑59375 allows authenticated users to force large dynamic memory allocations, potentially exhausting system resources.
Impact
- Versions 8.3.3.1 and earlier are affected.
- Severity: CVSS v3.1 base score 6.5 (Medium).
- Potential for DoS and, in some configurations, memory corruption.
- Worldwide deployment in critical energy infrastructure.
Mitigation
Hitachi Energy recommends applying the vendor patch that updates REB500 to version 8.3.4.0. No workarounds are currently available.
What to do
- Verify firmware version on all REB500 units.
- If < 8.3.4.0, schedule an update during maintenance windows.
- Monitor IEC61850 traffic for anomalous messages and block suspicious packets.
- Apply any additional network segmentation or rate‑limiting controls to mitigate DoS risk.
Related vulnerabilities
Debian Linux Kernel Vulnerabilities: Privilege Escalation, Data Breach, DoS – Immediate Update Required
Multiple kernel CVEs (CVE-2024-52560, CVE-2024-58094, CVE-2024-58095, CVE-2025-21817, CVE-2025-22104, CVE-2025-22108, CVE-2025-22127, CVE-2025-38203, CVE-2025-38205, CVE-2025-38206) affect Debian trixie kernels older than 6.12.111-1, enabling privilege escalation, confidentiality loss, and denial of service. Apply the Debian security bulletin msg00441 updates immediately and verify kernel version.
Read briefing
PHP Cryptomining Campaign Surge Oct/Nov 2025: ThinkPHP, PHP CGI, CVE-2024-4577
From August to November 2025, GreyNoise tracked a sharp rise in cryptomining attacks targeting PHP and its frameworks. Exploits centered on ThinkPHP LFI (CVE‑2022‑47945), PHP CGI (CVE‑2012‑1823), and the newly disclosed CVE‑2024‑4577. Defenders should patch immediately, block known malicious IP ranges, and monitor for suspicious mining activity.
Read briefing
CUPS RCE Vulnerabilities (CVE-2024-47176-47177) – Patch and Detect Now
CUPS printing system vulnerabilities (CVE-2024-47176-47177) allow unauthenticated remote code execution via IPP and mDNS on UDP port 631. Affected systems include Linux, BSD, ChromeOS and Solaris running CUPS <=2.0.1. Defenders should patch immediately, disable cups-browsed if unnecessary, block port 631, and deploy Elastic Security’s new detection rules.
Read briefing
CVE‑2025‑50165: Critical Windows Imaging Component RCE via Crafted JPEG
Microsoft’s WindowsCodecs.dll contains CVE‑2025‑50165, a critical flaw that can trigger remote code execution when a specially crafted JPEG is processed. The vulnerability is in the jpeg_finish_compress routine, and while Microsoft rates it critical, exploitability is considered low. Defenders should apply the latest Windows updates, disable unnecessary image processing on servers, and monitor for anomalous JPEG handling.
Read briefing