Description
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable
for a NULL pointer dereferencing, if a specially crafted
sequence of messages is sent for a certain time, causing
Denial of Service impact.
Product is only affected if IEC 60870-5-104 functionality in
bidirectional mode (BCI) is configured.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hitachi Energy | RTU500 series CMU firmware | 12.7.1 – ≤ 12.7.7, 13.5.1 – ≤ 13.5.4, 13.6.1 – ≤ 13.6.3, 13.7.1 – ≤ 13.7.8, 13.8.1 | — |
Advisories 1
- ICSA-26-155-04 Hitachi Energy RTU500 (Update A) CISA ICS & IT advisories · Nov 12, 2026