Lucene search

[email protected]CVE-2022-4608

HistoryJul 26, 2023 - 6:15 a.m.

CVE-2022-4608

2023-07-2606:15:10

CWE-120

CWE-787

[email protected]

web.nvd.nist.gov

vulnerability

hci

iec 60870-5-104

rtu500

stack overflow

restart

nvd

cve-2022-4608

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.0%

JSON

A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-3. After session resumption interval is expired an RTU500 initiated update of session parameters causes an unexpected restart due to a stack overflow.

Affected configurations

NVD

Node

hitachienergyrtu500_firmwareMatch13.3.1

hitachienergyrtu500_firmwareMatch13.3.2

hitachienergyrtu500_firmwareMatch13.3.3

hitachienergyrtu500_firmwareMatch13.4.1

AND

hitachienergyrtu500Match-

CPENameOperatorVersion
hitachienergy:rtu500_firmwarehitachienergy rtu500 firmwareeq13.3.1
hitachienergy:rtu500_firmwarehitachienergy rtu500 firmwareeq13.3.2
hitachienergy:rtu500_firmwarehitachienergy rtu500 firmwareeq13.3.3
hitachienergy:rtu500_firmwarehitachienergy rtu500 firmwareeq13.4.1

CPE	Name	Operator	Version
hitachienergy:rtu500_firmware	hitachienergy rtu500 firmware	eq	13.3.1
hitachienergy:rtu500_firmware	hitachienergy rtu500 firmware	eq	13.3.2
hitachienergy:rtu500_firmware	hitachienergy rtu500 firmware	eq	13.3.3
hitachienergy:rtu500_firmware	hitachienergy rtu500 firmware	eq	13.4.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "RTU500 series",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "status": "affected",
        "version": "RTU500 series CMU Firmware version 13.3.1"
      },
      {
        "status": "affected",
        "version": "RTU500 series CMU Firmware version 13.3.2"
      },
      {
        "status": "unaffected",
        "version": "RTU500 series CMU Firmware version 13.3.3"
      },
      {
        "status": "unaffected",
        "version": "RTU500 series CMU Firmware version 13.4.1"
      }
    ]
  }
]