{"id":"CVE-2025-10217","state":"PUBLISHED","title":"A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially carry","description":"A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially carrying out further malicious attacks. Performance logging is typically enabled for troubleshooting purposes while resolving application performance related issues.","publishedAt":"2025-09-30T12:10:23.803Z","updatedAt":"2025-10-28T10:28:45.480Z","severity":{"score":6,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","source":"Hitachi Energy"},"assigner":"Hitachi Energy","products":["Hitachi Energy Asset Suite"],"affected":[{"vendor":"Hitachi Energy","product":"Asset Suite","defaultStatus":"unaffected","versions":[{"version":"9.0","status":"affected","lessThanOrEqual":"9.8","versionType":"custom"}]}],"references":["https://publisher.hitachienergy.com/preview?DocumentID=8DBD000226&LanguageCode=en&DocumentPartId=&Action=Launch"],"weaknesses":["CWE-117"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/10xxx/CVE-2025-10217.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-10217","state":"PUBLISHED","datePublished":"2025-09-30T12:10:23.803Z","dateUpdated":"2025-10-28T10:28:45.480Z","assignerShortName":"Hitachi Energy","assignerOrgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateReserved":"2025-09-10T11:07:55.536Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially carrying out further malicious attacks. Performance logging is typically enabled for troubleshooting purposes while resolving application performance related issues."}],"affected":[{"vendor":"Hitachi Energy","product":"Asset Suite","defaultStatus":"unaffected","versions":[{"version":"9.0","status":"affected","lessThanOrEqual":"9.8","versionType":"custom"}]}],"references":[{"url":"https://publisher.hitachienergy.com/preview?DocumentID=8DBD000226&LanguageCode=en&DocumentPartId=&Action=Launch","tags":["vendor-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-117","description":"CWE-117 Improper Output Neutralization for Logs","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Hitachi Energy","orgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateUpdated":"2025-10-28T10:28:45.480Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hitachi_energy:asset_suite:*:*:*:*:*:*:*:*","versionEndIncluding":"9.8","versionStartIncluding":"9.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"impacts":[{"capecId":"CAPEC-93","descriptions":[{"lang":"en","value":"CAPEC-93 Log Injection-Tampering-Forging"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-30T13:04:01.987539Z","id":"CVE-2025-10217","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-30T13:04:07.996Z"}}]}}}