CVE-2022-28613
published 2022-05-02CVE-2022-28613: A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.99%
60.5th percentile
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| abb | rtu500_firmware | >= 12.2.1.0 < 12.2.12.0 | 12.2.12.0 |
| hitachi_energy | rtu500_series_cmu_firmware | — | — |
| hitachi_energy | rtu500_series_cmu_firmware | — | — |
| hitachi_energy | rtu500_series_cmu_firmware | — | — |
| hitachi_energy | rtu500_series_cmu_firmware | — | — |
| hitachi_energy | rtu500_series_cmu_firmware | — | — |
| hitachi_energy | rtu500_series_cmu_firmware | — | — |
| hitachienergy | rtu500_firmware | >= 12.0.1.0 < 12.0.14.0 | 12.0.14.0 |
| hitachienergy | rtu500_firmware | >= 12.4.1.0 < 12.4.12.0 | 12.4.12.0 |
| hitachienergy | rtu500_firmware | >= 12.6.1.0 < 12.6.8.0 | 12.6.8.0 |
| hitachienergy | rtu500_firmware | >= 12.7.1.0 < 12.7.4.0 | 12.7.4.0 |
| hitachienergy | rtu500_firmware | >= 13.2.1.0 < 13.2.5.0 | 13.2.5.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9m5v-m5wp-xcm2: A vulnerability in the HCI Modbus TCP COMPONENT of Hitachi Energy RTU500 series CMU Firmware that is caused by the validation error in the length info
ghsa_unreviewed·2022-05-03
CVE-2022-28613 [HIGH] CWE-1284 GHSA-9m5v-m5wp-xcm2: A vulnerability in the HCI Modbus TCP COMPONENT of Hitachi Energy RTU500 series CMU Firmware that is caused by the validation error in the length info
A vulnerability in the HCI Modbus TCP COMPONENT of Hitachi Energy RTU500 series CMU Firmware that is caused by the validation error in the length information carried in MBAP header allows an ATTACKER to reboot the device by sending a special crafted message. This issue affects: Hitachi Energy RTU500 series CMU Firmware 12.0.*; 12.2.*; 12.4.*; 12.6.*; 12.7.*; 13.2.*.
CISA ICS
Hitachi Energy RTU500 series
cisa_ics·2022-08-30·CVSS 7.5
[HIGH] Hitachi Energy RTU500 series
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Hitachi Energy RTU500 series
Last RevisedAugust 30, 2022
Alert CodeICSA-22-242-04
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: RTU500 series
- Vulnerability: Improper Input Validation
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could cause an internal buffer overflow, which can reboot the product.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Hitachi Energy reported this vulnerability affects the following RTU500 series in which HCI Modbus TCP is configured
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-05-02
Published