Summary
Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. Successful exploitation of these vulnerabilities can result in the exposure of low-value user management information and device outage. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
Vulnerabilities 4
-
High 8.7
IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is o…
-
High 7.5CVE-2024-8176 Public exploit
Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting …
-
High 7.5
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…
-
Medium 5.3
RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via…
Revision history
-
#5
Update A - CISA Republication update based on Hitachi Energy PSIRT 8DBD000237 advisory
-
#4
Updated fixed version 12.7.8
-
#3
Updated fixed version 13.8.2
-
#2
CISA Republication - Initial CISA Republication of Hitachi Energy PSIRT 8DBD000237 advisory
-
#1
Initial public release
References
-
[1] Hitachi Energy Notification for Industrial Control Systems Cybersecurity Best Practices
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000235&LanguageCode=en&DocumentPartId=&Action=Launch
-
Multiple Vulnerabilities in Hitachi Energy RTU500 Product
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000237&LanguageCode=en&DocumentPartId=&Action=launch
-
ICS Advisory ICSA-26-062-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-03
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b