Hitachi Energy Relion 670, 650, SAM600-IO Series (Update A)
Hitachi Energy is aware of the vulnerability CVE-2022-4304 in the OSS component OpenSSL, that affects the Relion 670, 650, SAM600-IO versions that are listed below. An attacker successfully exploiting this vulnerability could send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. For immediate mitigation/workaround information, please refer to the General Mitigation Factors/Workarounds
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-4304US | medium5.9 | Exploit | ||
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack.… | ||||
references
External citations — patches, advisories, analysis.
- OpenSSL Vulnerability in Hitachi Energy’s Relion 670, 650, SAM600-IO series Productself
- ICS Advisory ICSA-25-160-02 JSONself
- ICS Advisory ICSA-25-160-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- MitigationRelion 670/650 Series
Apply General Mitigation Factors
- FixedRelion 670 Series
Update to version 2.2.2.6 or latest
- FixedRelion 670/650 Series
Update to version 2.2.4.4 or latest
- FixedRelion 670/650/SAM600-IO Series
Update to version 2.2.1.9 or latest
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan