Skip to content
OpenAdvisories
Medium · 5.9 CVE-2022-3353 EUVD-2022-42738GHSA-r27w-hfm7-9mc2

IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products

Published Feb 21, 2023 · Updated Mar 12, 2025 · Assigned by Hitachi Energy

Vendor: Hitachi Energy Product: FOX61x TEGO1 Product: GMS600 Product: ITT600 SA Explorer Product: MicroSCADA X SYS600 Product: MSM Product: PWC600 Product: REB500 Product: Relion 650 Product: Relion® 670 Product: RTU500 Product: SAM600-IO Product: TXpert Hub CoreTec 4 Product: TXpert Hub CoreTec 5 Category: ICS / OT

Description

A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. 

An attacker could exploit the vulnerability by using a specially crafted message sequence, to force the IEC 61850 MMS-server communication stack, to stop accepting new MMS-client connections. 

Already existing/established client-server connections are not affected.

List of affected CPEs:

* cpe:2.3:o:hitachienergy:fox61x_tego1:r15b08:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16_3:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:fox61x_tego1:r1e01:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:fox61x_tego1:r1d02:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:fox61x_tego1:r1c07:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:fox61x_tego1:r1b02:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:gms600:1.3.0:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.1.*:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.5.*:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0.1:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.0:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.2:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.8.0:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.0.*:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.4:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.5:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.*:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4.1:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:mms:2.2.3:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:pwc600:1.0:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:pwc600:1.1:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:pwc600:1.2:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:reb500:7:*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:reb500:8:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relion670:1.2.*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relion670:2.0.*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relion650:1.1.*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relion650:1.3.*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relion650:2.1.*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relion670:2.1.*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.1:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.5:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relion670:2.2.*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:relion650:2.2.*:*:*:*:*:*:*:*
* cpe:2.3:o:hitachienergy:rtu500cmu:12.*.*:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:rtu500cmu:13.*.*:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:2.*:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:3.0:*:*:*:*:*:*:*
* cpe:2.3:a:hitachienergy:txpert_hub_coretec_5:3.0:*:*:*:*:*:*:*

Affected products

VendorProductAffectedFixed
Hitachi Energy FOX61x TEGO1 tego1_r15b08, tego1_r2a16_03, tego1_r2a16, tego1_r1e01, tego1_r1d02, tego1_r1c07, tego1_r1b02 tego1_r16a11
Hitachi Energy GMS600 GMS600 1.3 —
Hitachi Energy ITT600 SA Explorer ITT600 SA Explorer 1.1.0, ITT600 SA Explorer 1.1.1, ITT600 SA Explorer 1.1.2, ITT600 SA Explorer 1.5.0, ITT600 SA Explorer 1.5.1, ITT600 SA Explorer 1.6.0, ITT600 SA Explorer 1.6.0.1, ITT600 SA Explorer 1.7.0, ITT600 SA Explorer 1.7.2, ITT600 SA Explorer 1.8.0, ITT600 SA Explorer 2.0.1, ITT600 SA E… ITT600 SA Explorer 2.1.1.2
Hitachi Energy MicroSCADA X SYS600 SYS600 10, SYS600 10.1, SYS600 10.1.1, SYS600 10.2, SYS600 10.2.1, SYS600 10.3, SYS600 10.3.1, SYS600 10.4 SYS600 10.4.1
Hitachi Energy MSM MSM 2.2.3;0 —
Hitachi Energy PWC600 PWC600 1.0, PWC600 1.1, PWC600 1.2 —
Hitachi Energy REB500 REB500 7.0 – < 7.*, REB500 8.0 – < 8.* 7.*
Hitachi Energy Relion® 670 Relion 670 1.2, Relion 670 2.0, Relion 670 version 2.1, Relion 670 2.2.0, Relion 670 2.2.1, Relion 670 2.2.2, Relion 670 2.2.3, Relion 670 2.2.4, Relion 670 2.2.5 —
Hitachi Energy Relion® 650 Relion 650 1.1, Relion 650 1.3, Relion 650 2.1, Relion 650 2.2.0, Relion 650 2.2.1, Relion 650 2.2.2, Relion 650 2.2.3, Relion 650 2.2.4, Relion 650 2.2.5 —
Hitachi Energy SAM600-IO Relion SAM600-IO 2.2.1, Relion SAM600-IO 2.2.5 —
Hitachi Energy RTU500 RTU500 12.0.1 – ≤ 12.0.14, RTU500 12.2.1 – ≤ 12.2.11, RTU500 12.4.1 – ≤ 12.4.11, RTU500 12.6.1 – ≤ 12.6.8, RTU500 12.7.1 – ≤ 12.7.4, RTU500 13.2.1 – ≤ 13.2.5, RTU500 13.3.1 – ≤ 13.3.3, RTU500 13.4.1 RTU500 12.0.15
Hitachi Energy TXpert Hub CoreTec 4 CoreTec 4 version 2.0.*, CoreTec 4 version 2.1.*, CoreTec 4 version 2.2.*, CoreTec 4 version 2.3.*, CoreTec 4 version 2.4.*, CoreTec 4 version 3.0.* —
Hitachi Energy TXpert Hub CoreTec 5 CoreTec 5 version 3.0.* —

Advisories 2

References