Hosaka PSIRT investigates reports of vulnerabilities in Hosaka products and publishes advisories when a vulnerability affects a product we have released. Because many Hosaka products are built into other companies' equipment, we notify OEM customers before publication so that they can prepare updates; owners of such equipment should contact its manufacturer.
To report a vulnerability, write to Hosaka PSIRT at psirt@hosakacorporation.com. We acknowledge reports within three business days (Japan time). Our security.txt gives the same contact.
2026
-
HSA-26-0002: Denial of service in H-BMC through malformed management requests
HS-2200 series, HS-1100 series (H-BMC 2.23 and earlier)
-
HSA-26-0001: Insecure default setting of the maintenance web interface of VP-1300 panel computers
VP-1300 series (OS image 2.4 and earlier)
The maintenance web interface was enabled by default and reachable from the production network. Fix: OS image 2.5 and later disables it by default.
2025
-
HSA-25-0003: Improper certificate validation in the remote service interface of the SC-340M
SC-340M (platform firmware 4.11 and earlier), including OEM variants
-
HSA-25-0002: Vulnerabilities in a third-party SSH server component of RC-7100
RC-7100 (Linux image 3.1 and earlier)
A third-party SSH server included in the Linux image is affected by publicly known vulnerabilities. Fix: Linux image 3.2 and later.
-
HSA-25-0001: Outdated Secure Boot revocation list in FC-2200 firmware
FC-2200 (BIOS R1.18 and earlier)
The firmware did not include recent revocations, allowing a revoked boot loader to start. Fix: BIOS R1.21 and later.
2024
-
HSA-24-0003: Cross-site scripting in the SC-520 web console
SC-520 (firmware 1.6 and earlier)
Device names entered in the web console were not escaped. Fix: Firmware 1.7 and later.
-
HSA-24-0002: Hard-coded credentials for a factory test account in H-BMC 1.x
HS-2100 series (H-BMC 1.47 and earlier)
An account used for factory testing was left enabled with a fixed password. Fix: H-BMC 1.48 and later removes the account.
-
HSA-24-0001: Denial of service in the SC-230 fieldbus interface
SC-230 (firmware 2.3 and earlier)
Malformed frames could stop fieldbus communication until restart. Fix: Firmware 2.4 and later.
2023
-
HSA-23-0002: Use of a weak hash for stored passwords in VP-1300 user management
VP-1300 series (OS image 2.1 and earlier)
Local user passwords were stored with a weak hash. Fix: OS image 2.2 and later.
-
HSA-23-0001: Hosaka products affected by vulnerabilities in a widely used open-source logging library
None affected (investigation result)
Hosaka investigated all current products. None use the affected library. Fix: No action required.
2021
-
HSA-21-0001: Hosaka products affected by vulnerabilities in a third-party TCP/IP stack
SC-230, SC-460 (firmware before Dec. 2021)
A third-party network stack used in two controllers is affected by publicly known vulnerabilities. Fix: Updated firmware for each product; see the advisory.
2020
-
HSA-20-0001: Unauthenticated access to diagnostic data on SC-460 maintenance port
SC-460 (firmware 1.9 and earlier)
Diagnostic data could be read from the maintenance port without authentication. Fix: Firmware 2.0 and later.