Skip to content
OpenAdvisories
Medium ICSA-26-141-01 1 CVE

Hitachi Energy GMS600

Published Jun 27, 2023 · Updated May 21, 2026 · Revision 3

Vendor: Hitachi Energy Product: GMS600

Summary

Hitachi Energy is aware of the vulnerability, CVE-2022-4304 in the OSS component OpenSSL, that affects the GMS600 versions that are listed below. An attacker successfully exploiting this vulnerability could send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. For immediate mitigation /workaround information, please refer to the General Mitigation Factors/Workarounds

Vulnerabilities 1

  • Medium 5.9
    CVE-2022-4304 Public exploit EPSS 24%

    Timing Oracle in RSA Decryption

    A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io

Revision history

  1. #3

    Initial CISA Republication of Hitachi Energy PSIRT 8DBD000159 advisory

  2. #2

    Updated fixed version.

  3. #1

    Initial public release.

References