Hitachi Energy Relion 670, 650 and SAM600-IO Series
Hitachi Energy is aware of a report from Nozomi Networks Labs, concerning the vulnerability CVE-2022-3864 affecting the Relion 670/650/SAM600-IO series versions listed below. Recommended actions for each affected version are listed in the “Recommended Immediate Actions” section of this document. An attacker who manages to get access with security privileges to the device, can start the update mechanism, supplying a malicious update package to the IED. When the system attempts to verify the tampered update package, a crash occurs resulting in the reboot of the device, after reboot the device is back in normal operation.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3864US | medium4.5OT elevated | — | ||
A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device is back to normal oper… | ||||
references
External citations — patches, advisories, analysis.
- Cybersecurity Advisory - IEC 61850 MMS-Server Vulnerability in Hitachi Energy’s Relion®670, 650 series and SAM600-IO Productsself
- ICS Advisory ICSA-23-068-05 JSONself
- ICS Advisory ICSA-23-068-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (5)
- MitigationRelion 650
Apply General Mitigation Factors
- MitigationRelion 670
Apply General Mitigation Factors
- FixedRelion 650
For more information, see Hitachi Energy cybersecurity advisory 8DBD000146 at https://publisher.hitachienergy.com/preview?DocumentID=8DBD000146&LanguageCode=en .
- FixedRelion 670
For more information, see Hitachi Energy cybersecurity advisory 8DBD000146 at https://publisher.hitachienergy.com/preview?DocumentID=8DBD000146&LanguageCode=en .
- FixedSAM600-IO
For more information, see Hitachi Energy cybersecurity advisory 8DBD000146 at https://publisher.hitachienergy.com/preview?DocumentID=8DBD000146&LanguageCode=en .
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan