cnvd - cnvd-2025-02742

cnvd-2025-02742

Vulnerability from cnvd

Title: Hitachi Energy RTU500 series CMU firmware缓冲区溢出漏洞

Description:

RTU500是日本日立制作所（Hitachi）公司的一系列工控组件，主要用于工业控制系统。

Hitachi Energy RTU500 series CMU firmware HCI Modbus TCP功能存在缓冲区溢出漏洞，该漏洞源于启用并配置了HCI Modbus TCP，攻击者可利用漏洞通过向RTU500高速发送特制消息，导致HCI Modbus TCP功能中的内部堆栈溢出，并最终导致RTU500 CMU重新启动。

Severity: 高

Patch Name: Hitachi Energy RTU500 series CMU firmware缓冲区溢出漏洞的补丁

Patch Description:

RTU500是日本日立制作所（Hitachi）公司的一系列工控组件，主要用于工业控制系统。

Formal description:

厂商已发布补丁修复漏洞，请广大用户及时下载更新： https://search.abb.com/library/Download.aspx?DocumentID=8DBD000111&LanguageCode=en&DocumentPartId=&Action=Launch

Reference: https://us-cert.cisa.gov/ics/advisories/icsa-22-235-07

Impacted products

Name
['Hitachi Energy RTU500 series CMU Firmware >=12.0.1.0，<=12.0.14.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.2.1.0，<=12.2.11.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.4.1.0，<=12.4.11.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.6.1.0，<=12.6.7.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.7.1.0，<=12.7.3.0', 'Hitachi Energy RTU500 series CMU Firmware >=13.2.1.0，<=13.2.4.0', 'Hitachi Energy RTU500 series CMU Firmware 13.3.1.0']

Name

['Hitachi Energy RTU500 series CMU Firmware >=12.0.1.0，<=12.0.14.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.2.1.0，<=12.2.11.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.4.1.0，<=12.4.11.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.6.1.0，<=12.6.7.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.7.1.0，<=12.7.3.0', 'Hitachi Energy RTU500 series CMU Firmware >=13.2.1.0，<=13.2.4.0', 'Hitachi Energy RTU500 series CMU Firmware 13.3.1.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-2081"
    }
  },
  "description": "RTU500\u662f\u65e5\u672c\u65e5\u7acb\u5236\u4f5c\u6240\uff08Hitachi\uff09\u516c\u53f8\u7684\u4e00\u7cfb\u5217\u5de5\u63a7\u7ec4\u4ef6\uff0c\u4e3b\u8981\u7528\u4e8e\u5de5\u4e1a\u63a7\u5236\u7cfb\u7edf\u3002\n\nHitachi Energy RTU500 series CMU firmware HCI Modbus TCP\u529f\u80fd\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u542f\u7528\u5e76\u914d\u7f6e\u4e86HCI Modbus TCP\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u5411RTU500\u9ad8\u901f\u53d1\u9001\u7279\u5236\u6d88\u606f\uff0c\u5bfc\u81f4HCI Modbus TCP\u529f\u80fd\u4e2d\u7684\u5185\u90e8\u5806\u6808\u6ea2\u51fa\uff0c\u5e76\u6700\u7ec8\u5bfc\u81f4RTU500 CMU\u91cd\u65b0\u542f\u52a8\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u8865\u4e01\u4fee\u590d\u6f0f\u6d1e\uff0c\u8bf7\u5e7f\u5927\u7528\u6237\u53ca\u65f6\u4e0b\u8f7d\u66f4\u65b0\uff1a\r\nhttps://search.abb.com/library/Download.aspx?DocumentID=8DBD000111\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-02742",
  "openTime": "2025-02-13",
  "patchDescription": "RTU500\u662f\u65e5\u672c\u65e5\u7acb\u5236\u4f5c\u6240\uff08Hitachi\uff09\u516c\u53f8\u7684\u4e00\u7cfb\u5217\u5de5\u63a7\u7ec4\u4ef6\uff0c\u4e3b\u8981\u7528\u4e8e\u5de5\u4e1a\u63a7\u5236\u7cfb\u7edf\u3002\r\n\r\nHitachi Energy RTU500 series CMU firmware HCI Modbus TCP\u529f\u80fd\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u542f\u7528\u5e76\u914d\u7f6e\u4e86HCI Modbus TCP\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u5411RTU500\u9ad8\u901f\u53d1\u9001\u7279\u5236\u6d88\u606f\uff0c\u5bfc\u81f4HCI Modbus TCP\u529f\u80fd\u4e2d\u7684\u5185\u90e8\u5806\u6808\u6ea2\u51fa\uff0c\u5e76\u6700\u7ec8\u5bfc\u81f4RTU500 CMU\u91cd\u65b0\u542f\u52a8\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Hitachi Energy RTU500 series CMU firmware\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.0.1.0\uff0c\u003c=12.0.14.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.2.1.0\uff0c\u003c=12.2.11.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.4.1.0\uff0c\u003c=12.4.11.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.6.1.0\uff0c\u003c=12.6.7.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.7.1.0\uff0c\u003c=12.7.3.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=13.2.1.0\uff0c\u003c=13.2.4.0",
      "Hitachi Energy RTU500 series CMU Firmware 13.3.1.0"
    ]
  },
  "referenceLink": "https://us-cert.cisa.gov/ics/advisories/icsa-22-235-07",
  "serverity": "\u9ad8",
  "submitTime": "2022-08-26",
  "title": "Hitachi Energy RTU500 series CMU firmware\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2022-2081 (GCVE-0-2022-2081)

Vulnerability from cvelistv5

Published

2024-01-04 09:15

Modified

2025-05-22 18:20

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-787 - Out-of-bounds Write

Summary

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function.

References

▼	URL	Tags
	https://publisher.hitachienergy.com/preview?DocumentID=8DBD000111&LanguageCode=en&DocumentPartId=&Action=Launch

Impacted products

	Vendor	Product	Version
	Hitachi Energy	RTU500 series CMU firmware	Version: 12.0.1.0 < Version: 12.2.1.0 < Version: 12.4.1.0 < Version: 12.6.1.0 < Version: 12.7.1.0 < Version: 13.2.1.0 < Version: 13.3.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.276Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000111\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-04T17:17:18.805708Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T18:20:49.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RTU500 series CMU firmware",
          "vendor": "Hitachi Energy",
          "versions": [
            {
              "lessThanOrEqual": "12.0.13.0",
              "status": "affected",
              "version": "12.0.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.11.0",
              "status": "affected",
              "version": "12.2.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.11.0",
              "status": "affected",
              "version": "12.4.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.6.7.0",
              "status": "affected",
              "version": "12.6.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.7.3.0",
              "status": "affected",
              "version": "12.7.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.2.4.0",
              "status": "affected",
              "version": "13.2.1.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "13.3.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function."
            }
          ],
          "value": "A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T14:31:33.084Z",
        "orgId": "e383dce4-0c27-4495-91c4-0db157728d17",
        "shortName": "Hitachi Energy"
      },
      "references": [
        {
          "url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000111\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17",
    "assignerShortName": "Hitachi Energy",
    "cveId": "CVE-2022-2081",
    "datePublished": "2024-01-04T09:15:30.332Z",
    "dateReserved": "2022-06-14T12:21:15.314Z",
    "dateUpdated": "2025-05-22T18:20:49.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted