Hitachi Energy's RTU500 Series Product (UPDATE B)
Successful exploitation of these vulnerabilities could allow an attacker to crash the device being accessed or cause a denial-of-service condition.
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-0286US | high7.4 | — | ||
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure def… | ||||
| CVE-2022-4304US | medium5.9 | Exploit | ||
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack.… | ||||
| CVE-2022-23937US | high7.5 | — | ||
In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario. | ||||
| CVE-2022-0778US | high7.5 | Exploit | ||
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi… | ||||
| CVE-2021-3712US | high7.4 | Exploit | ||
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This cont… | ||||
| CVE-2021-3711US | critical9.8 | — | ||
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first tim… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-23-143-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-23-143-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (12)
- MitigationRTU500 series CMU Firmware
Do not allow process control systems direct connections to the internet.
- MitigationRTU500 series CMU Firmware
Do not allow process control systems direct connections to the internet.
- MitigationRTU500 series CMU Firmware
Do not allow process control systems direct connections to the internet.
- MitigationRTU500 series CMU Firmware
Do not allow process control systems direct connections to the internet.
- MitigationRTU500 series CMU Firmware
Do not allow process control systems direct connections to the internet.
- MitigationRTU500 series CMU Firmware
Do not allow process control systems direct connections to the internet.
- FixedRTU500 series CMU Firmware
RTU500 series CMU Firmware version 12.0.1 - 12.0.14: Update to CMU Firmware version 12.0.15* (Planned Update)
- FixedRTU500 series CMU Firmware
RTU500 series CMU Firmware version 12.0.1 - 12.0.14: Update to CMU Firmware version 12.0.15* (Planned Update)
- FixedRTU500 series CMU Firmware
RTU500 series CMU Firmware version 12.0.1 - 12.0.14: Update to CMU Firmware version 12.0.15* (Planned Update)
- FixedRTU500 series CMU Firmware
RTU500 series CMU Firmware version 12.0.1 - 12.0.14: Update to CMU Firmware version 12.0.15* (Planned Update)
- FixedRTU500 series CMU Firmware
RTU500 series CMU Firmware version 12.0.1 � 12.0.14: Update to CMU Firmware version 12.0.15* (Planned Update)
- FixedRTU500 series CMU Firmware
RTU500 series CMU Firmware version 12.0.1 � 12.0.14: Update to CMU Firmware version 12.0.15* (Planned Update)
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan