Hitachi Energy's RTU500 series NULL Pointer Deference (CVE-2024-11499)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503160);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/04/14");

  script_cve_id("CVE-2024-11499");
  script_xref(name:"ICSA", value:"25-093-01");

  script_name(english:"Hitachi Energy's RTU500 series NULL Pointer Deference (CVE-2024-11499)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");

  script_set_attribute(attribute:"description", value:
"A vulnerability exists in RTU500 IEC 60870-4-104 con-
trolled station functionality, that allows an authenti-
cated and authorized attacker to perform a CMU re-
start. The vulnerability can be triggered if certificates
are updated while in use on active connections.
The affected CMU will automatically recover itself if an
attacker successfully exploits this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
# https://publisher.hitachienergy.com/preview?DocumentID=8DBD000207&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5910065f");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Hitachi Energy has identified the following specific workarounds and mitigations users can apply to reduce risk:

- For all versions, apply general mitigation factors/workarounds. Upgrade the system once remediated version is available, or apply general mitigation factors.
- RTU500 series CMU 12.0.1 - 12.0.14, 12.2.1 - 12.2.12, 12.4.1 - 12.4.11, 12.6.1 - 12.6.10, 12.7.1 - 12.7.7: Update to version 12.7.8 when available.
- RTU500 series CMU version 13.2.1 - 13.2.7, 13.4.1 - 13.4.4, 13.5.1 - 13.5.3, 13.6.1: Update to version 13.7.1
- RTU500 series CMU 13.5.1 - 13.5.3: Update to version 13.5.4 when available.
- RTU500 series CMU 13.6.1: Update to version 13.6.2 when available.
- (CVE-2024-11499, CVE-2025-1445) RTU500 series CMU 13.7.1 - 13.7.4: Update to version 13.7.6 when available.
- (CVE-2024-12169) RTU500 series CMU 13.4.1 - 13.4.4, 13.5.1 - 13.5.3, 13.6.1, 13.7.1 - 13.7.4: Update to version 13.7.6 when available.

For more information see the associated Hitachi Energy PSIRT security advisory 8DBD000207.

Hitachi Energy recommends users implement recommended security practices and firewall configurations to help
protect the process control network from attacks originating from outside the network. Process control systems
should be physically protected from direct access by unauthorized personnel, have no direct connections to the
Internet, and be separated from other networks by means of a firewall system with a minimal number of ports
exposed. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.
Portable computers and removable storage media should be carefully scanned for viruses before they are connected
to a control system.

For more information, see Hitachi Energy's Security Advisories.");

  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/R:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-11499");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/03/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/04/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu500_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}

include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:hitachienergy:rtu500_firmware:13.4" :
        {"versionEndIncluding" : "13.4.4", "versionStartIncluding" : "13.4.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu500_firmware:13.5" :
        {"versionEndIncluding" : "13.5.3", "versionStartIncluding" : "13.5.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu500_firmware:13.6" :
        {"versionEndIncluding" : "13.6.1", "versionStartIncluding" : "13.6.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu500_firmware:13.7" :
        {"versionEndIncluding" : "13.7.1", "versionStartIncluding" : "13.7.1", "family" : "AbbRTU500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);