# Hitachi Energy PROMOD V Exposes Power Grid Operations to Data Interception via Unencrypted Communications


## The Threat


Hitachi Energy has disclosed a critical vulnerability in PROMOD V, a software platform used to manage and optimize grid operations in the global energy sector. The flaw, tracked as CVE-2026-10763, stems from the application's reliance on unencrypted HTTP communications instead of HTTPS, creating a direct pathway for attackers to intercept, eavesdrop on, and manipulate sensitive operational data transmitted across networks.


The vulnerability exists because PROMOD V's underlying infrastructure—specifically its integration with the third-party Digipede Grid server—lacks native HTTPS support. This architectural dependency means that all communications between PROMOD V instances and Digipede servers traverse the network in cleartext, exposing authentication credentials, operational commands, and real-time grid state information to anyone positioned to observe network traffic.


For organizations operating critical energy infrastructure, this creates a textbook attack surface: an adversary positioned on the same network segment—whether through compromised corporate devices, rogue WiFi access points, or internet-facing infrastructure—could harvest session tokens, forge administrative commands, and hijack authenticated sessions without deploying malware or defeating any encryption. The impact ranges from data exfiltration to live manipulation of grid operations, making this far more than a passive confidentiality issue.


## Severity and Impact


| Attribute | Details |

|-----------|---------|

| CVE ID | CVE-2026-10763 |

| CVSS v3.1 Score | 7.1 (HIGH) |

| CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N |

| CVSS v4.0 Score | 7.0 (HIGH) |

| CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |

| CWE | CWE-1428: Reliance on HTTP instead of HTTPS |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | Required |

| Scope | Unchanged |

| Confidentiality | High Impact |

| Integrity | Low Impact |

| Availability | None |


## Affected Products


Hitachi Energy PROMOD V:

  • Version 1.0.10 and all prior versions
  • Status: Known affected

    • The vulnerability affects deployments worldwide across the energy sector, with Hitachi Energy headquarters in Switzerland coordinating the disclosure and remediation effort.


    ## Mitigations


    Vendor-Provided Fix:

    Hitachi Energy has released PROMOD V version 1.0.11, which includes HTTPS support and resolves the insecure HTTP transmission vulnerability. The upgrade path includes:

  • Upgrade PROMOD V to version 1.0.11 or later
  • Enable HTTPS on the Digipede Grid server as outlined in the 1.0.11 PROMOD V User Guide (Section 2: Essential Skills > Running PROMOD V > Digipede Grid)
  • The same guidance is available in the online help within the application

    • Interim Mitigations (Until Patching):

  • Implement network segmentation to isolate PROMOD V instances and limit access to trusted administrative systems only
  • Deploy a firewall with minimal port exposure between PROMOD V systems and external networks
  • Restrict PROMOD V access to dedicated, hardened networks with no direct internet connections
  • Implement VPN or encrypted tunneling for any remote access to PROMOD V instances
  • Monitor network traffic for suspicious HTTP communications to PROMOD V systems and Digipede servers
  • Enforce strong password policies and multi-factor authentication for all PROMOD V administrative accounts
  • Never use PROMOD V systems for general internet browsing, email, or instant messaging
  • Scan portable computers and removable media for malware before connecting to control system networks
  • Maintain segregation of energy infrastructure from corporate networks using air-gapped or heavily monitored connections

    • ## References


  • Hitachi Energy Security Advisory: https://www.hitachienergy.com/contact-us/
  • CISA Industrial Control Systems Cybersecurity: Refer to CISA ICS cybersecurity best practices and alert mechanisms
  • PROMOD V Documentation: Consult the 1.0.11 PROMOD V User Guide for detailed upgrade and HTTPS enablement procedures
  • CVE-2026-10763: National Vulnerability Database entry (available via CVE.MITRE.org)

    • ---


    ## HackWire Analysis


    This vulnerability exposes a persistent architectural weakness in industrial control systems: the reliance on third-party components that lag in security posture. Hitachi Energy cannot force HTTPS on PROMOD V without Digipede's cooperation—meaning security was constrained by a supply chain dependency rather than by business need or technical limitation. This pattern repeats across critical infrastructure globally, where legacy systems and vendor ecosystems create rigid constraints on security upgrades.


    The requirement for user interaction (UI:R) might suggest lower urgency, but in practice, energy operators authenticate to PROMOD V routinely as part of normal grid management. A credential harvested via man-in-the-middle attack on unencrypted HTTP becomes immediately actionable for lateral movement, persistence, or operational sabotage. The CVSS score reflects high confidentiality impact (credential and session compromise) paired with low integrity impact—but that "low" understates the risk; hijacked sessions could issue real grid commands before detection.


    What's noteworthy: energy utilities deploying PROMOD V face competing pressures. Critical infrastructure is hardened against external attack via air-gapping and network segmentation, but insider threats, supply chain compromises, and corporate network breaches routinely create internal network positions from which HTTP interception is trivial. A contractor's laptop on the same segment, a rogue WiFi access point in a utility substation, or a compromised VPN appliance all become viable attack vectors. The six-month patch window between 1.0.10 and 1.0.11 likely saw widespread deployment; utilities typically batch control system updates quarterly or semi-annually to minimize operational risk, meaning many organizations will remain exposed well into 2026.


    The broader lesson: HTTPS is not optional in 2026, even for "secured" systems. Hitachi Energy's dependency on a third-party server for core communication should have triggered HTTPS as a non-negotiable requirement from the start. Organizations running older PROMOD V versions should prioritize this upgrade alongside other critical patches, and Hitachi Energy should commit to phasing out HTTP entirely in future releases.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)