Skip to content
OpenAdvisories
Critical ICSA-25-155-02 2 CVEs

Hitachi Energy Relion 670 650 series and SAM600-IO Product

Published Dec 16, 2021 · Updated May 27, 2025 · Revision 2

Vendor: Hitachi Energy Product: Relion 650 Product: Relion® 670 Product: SAM-IO

Summary

Hitachi Energy is aware of two critical memory allocation vulnerabilities (called BadAlloc [1] vulnerabilities) in the WindRiver VxWorks Operating Systems [2][3] that are used in our product versions listed in this advisory.
An attacker that exploits these vulnerabilities might bypass security controls to execute malicious code or cause a denial-of-service. For immediate mitigation/workaround information, please refer to the Mitigation Fac-tors/Workaround Section.

[1] BadAlloc – Microsoft’s Section 52 - https://msrc-blog.microsoft.com/2021/04/29/badalloc-memory-allo-cation-vulnerabilities-could-affect-wide-range-of-iot-and-ot-devices-in-industrial-medical-and-enterprise-networks/
[2] Wind River VxWorks – CVE-2020-28895 Advisory - https://support2.windriver.com/in-dex.php?page=cve&on=view&id=CVE-2020-28895
[3] Wind River VxWorks – CVE-2020-35198 Advisory - https://support2.windriver.com/in-dex.php?page=cve&on=view&id=CVE-2020-35198

Vulnerabilities 2

  • High 7.3
    CVE-2020-28895

    integer overflow in calloc

    In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corrupti…

  • Unscored —
    CVE-2020-35198

    An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a …

Revision history

  1. #2

    Update to Recommended Actions table with fixed versions

  2. #1

    Initial version.

References