CVE-2025-24317 Overview
CVE-2025-24317 is a resource allocation vulnerability affecting JTEKT ELECTRONICS HMI ViewJet C-more series and HMI GC-A2 series human-machine interface (HMI) devices. The flaw stems from allocation of resources without limits or throttling [CWE-770]. A remote, unauthenticated attacker can send crafted network traffic to exhaust device resources and trigger a denial-of-service (DoS) condition. Because HMI devices sit on operational technology (OT) networks controlling industrial processes, loss of availability can disrupt operator visibility and control over connected equipment.
Critical Impact
Remote unauthenticated attackers can disrupt HMI availability on industrial control system networks, potentially interrupting operator control over connected industrial processes.
Affected Products
- JTEKT ELECTRONICS HMI ViewJet C-more series
- JTEKT ELECTRONICS HMI GC-A2 series
- Refer to JTEKT security advisories for specific firmware versions
Discovery Timeline
- 2025-04-04 - CVE-2025-24317 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24317
Vulnerability Analysis
The vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling. The affected HMI firmware accepts network requests without enforcing bounds on the volume, frequency, or size of resources it will allocate per connection or session. An attacker submits repeated or malformed requests over the network, consuming memory, connection slots, or processing capacity until the device becomes unresponsive.
The impact is limited to availability. Confidentiality and integrity are not affected because the flaw does not expose data or permit code execution. In an OT context, however, loss of HMI availability can prevent operators from monitoring or intervening in live processes.
Root Cause
The root cause is missing rate limiting and resource caps within the HMI network service. The device processes incoming requests without accounting for cumulative resource consumption, allowing a single remote actor to saturate available capacity.
Attack Vector
Exploitation requires network access to the HMI device. No authentication and no user interaction are required. Attackers on the same OT segment, or with routed access through an insufficiently segmented enterprise network, can send a stream of requests to exhaust device resources. See the JVN Vulnerability Report for vendor-coordinated details.
No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported.
Detection Methods for CVE-2025-24317
Indicators of Compromise
- HMI devices becoming unresponsive or rebooting unexpectedly during production
- Sustained inbound connection spikes toward HMI IP addresses from unexpected sources
- Elevated failed or timed-out sessions between engineering workstations and affected HMIs
Detection Strategies
- Baseline normal HMI network traffic patterns and alert on deviations in request rate or session counts
- Deploy OT-aware network intrusion detection to identify protocol-level flooding against HMI devices
- Correlate HMI availability alarms from SCADA historians with concurrent network anomalies
Monitoring Recommendations
- Enable syslog forwarding from HMIs and network switches to a central log platform for correlation
- Monitor firewall counters at IT/OT boundaries for unusual traffic volumes destined for HMI subnets
- Track HMI uptime and service health through periodic ICMP or application-layer probes
How to Mitigate CVE-2025-24317
Immediate Actions Required
- Inventory all HMI ViewJet C-more and HMI GC-A2 devices and identify their firmware versions
- Restrict network reachability so only authorized engineering workstations and HMIs can communicate with the affected devices
- Apply vendor firmware updates as soon as they are validated in a staging environment
Patch Information
JTEKT ELECTRONICS has published remediation guidance. Review the JTEKT Security Update 2025-01 and JTEKT Security Update 2025-02 advisories for firmware versions and installation procedures specific to each affected product family.
Workarounds
- Place affected HMIs behind an industrial firewall and restrict inbound connections to a whitelist of trusted hosts
- Enforce network segmentation between enterprise IT and OT zones following ISA/IEC 62443 zone-and-conduit principles
- Disable unused network services on the HMI and block non-essential ports at the perimeter
- Apply rate limiting on upstream network devices to constrain traffic volumes reaching the HMI
# Example firewall rule set restricting HMI access to authorized engineering workstations
# Replace addresses with values appropriate to your environment
iptables -A FORWARD -s 10.10.20.0/24 -d 10.20.30.5 -p tcp --dport 502 -j ACCEPT
iptables -A FORWARD -d 10.20.30.5 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
