Skip to content
OpenAdvisories
Medium ICSA-25-160-02 1 CVE

Hitachi Energy Relion 670, 650, SAM600-IO Series (Update A)

Published Jun 27, 2023 · Updated Mar 17, 2026 · Revision 5

Vendor: Hitachi Energy Product: Relion 670 Series Product: Relion 670/650 Series Product: Relion 670/650/SAM600-IO Series

Summary

Hitachi Energy is aware of the vulnerability CVE-2022-4304 in the OSS component OpenSSL, that affects the Relion 670, 650, SAM600-IO versions that are listed below. An attacker successfully exploiting this vulnerability could send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. For immediate mitigation/workaround information, please refer to the General Mitigation Factors/Workarounds

Vulnerabilities 1

  • Medium 5.9
    CVE-2022-4304 Public exploit EPSS 24%

    Timing Oracle in RSA Decryption

    A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io

Revision history

  1. #5

    CISA Republication update based on Hitachi Energy PSIRT 8DBD000157 advisory

  2. #4

    Updated Recommended Immediate Actions table with fixed version 2.2.1.9

  3. #3

    Updated - Affected Product Versions & Recommended Immediate Actions

  4. #2

    CISA Republication - Initial version.

  5. #1

    Initial public release.

References