Hitachi Energy e-mesh EMS

Summary

Vulnerabilities 4

• Low 3.7
  CVE-2020-11080

  Denial of service in nghttp2

  In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

  nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine
  Jun 3, 2020
• Unscored —
  CVE-2020-8174

  napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

  nodejs nodejs nodejs nodejs-current Debian Ubuntu Alpine
  Jul 24, 2020
• Unscored —
  CVE-2020-8265

  Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Jan 6, 2021
• Unscored —
  CVE-2021-22883 EPSS 77%

  Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connect…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Mar 3, 2021

Revision history

1. 2022-03-31 #1

   ICSA-22-090-02 Hitachi Energy e-mesh EMS

References

• ICS Advisory ICSA-22-090-02 Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-22-090-02
• Recommended Practices
  https://www.cisa.gov/news-events/ics-advisories/icsa-22-090-02
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B