ICSA-25-065-01

Hitachi Energy PCU400

Advisory ansehen veröffentlicht 2025-02-25

Hitachi Energy is aware of the multiple vulnerabilities related to various versions of OpenSSL library components used in PCU400 versions listed in this document below for IEC62351-3 secure for IEC104/DNP3 or PCULogger tool. These vulnerabilities if exploited, can cause confidentiality and availability impacts. Refer to the Recommended Immediate Actions for information about the available mitigation/remediation strategies.

beschreibt (8)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-4203US	medium4.9	1.39% (72nd)	—	2023-02-24
A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verifica…
CVE-2023-0401US	high7.5	1.85% (79th)	—	2023-02-08
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the…
CVE-2023-0286US	high7.4	69.3% (99th)	—	2023-02-08
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure def…
CVE-2023-0217US	high7.5	1.85% (79th)	—	2023-02-08
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely…
CVE-2023-0216US	high7.5	1.85% (79th)	—	2023-02-08
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. T…
CVE-2023-0215US	high7.5	5.02% (92nd)	—	2023-02-08
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 st…
CVE-2022-4450US	high7.5	28.6% (98th)	—	2023-02-08
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds th…
CVE-2022-4304US	medium5.9	23.5% (98th)	Exploit	2023-02-08
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack.…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

CYBERSECURITY ADVISORY - OpenSSL Vulnerabilities in Hitachi Energy PCU400 Productself
ICS Advisory ICSA-25-065-01 JSONself
Recommended Practicesexternal
ICS Advisory ICSA-25-065-01 - Web Versionself
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal

Behebungen (24)

Kein Fix geplantPCULogger versions 1.1.0 and below
If the PCULogger program is used, then update to version 1.2.0* when available. This version is compatible with PCU400 9.4.2 and later
Kein Fix geplantPCULogger versions 1.1.0 and below
If the PCULogger program is used, then update to version 1.2.0* when available. This version is compatible with PCU400 9.4.2 and later
Kein Fix geplantPCULogger versions 1.1.0 and below
If the PCULogger program is used, then update to version 1.2.0* when available. This version is compatible with PCU400 9.4.2 and later
Kein Fix geplantPCULogger versions 1.1.0 and below
If the PCULogger program is used, then update to version 1.2.0* when available. This version is compatible with PCU400 9.4.2 and later
Kein Fix geplantPCULogger versions 1.1.0 and below
If the PCULogger program is used, then update to version 1.2.0* when available. This version is compatible with PCU400 9.4.2 and later
Kein Fix geplantPCULogger versions 1.1.0 and below
If the PCULogger program is used, then update to version 1.2.0* when available. This version is compatible with PCU400 9.4.2 and later
Kein Fix geplantPCULogger versions 1.1.0 and below
If the PCULogger program is used, then update to version 1.2.0* when available. This version is compatible with PCU400 9.4.2 and later
Kein Fix geplantPCULogger versions 1.1.0 and below
If the PCULogger program is used, then update to version 1.2.0* when available. This version is compatible with PCU400 9.4.2 and later
BehobenPCU400 versions 6.5 K and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 6.6.0 or latest
BehobenPCU400 versions 6.5 K and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 6.6.0 or latest
BehobenPCU400 versions 6.5 K and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 6.6.0 or latest
BehobenPCU400 versions 6.5 K and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 6.6.0 or latest
BehobenPCU400 versions 6.5 K and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 6.6.0 or latest
BehobenPCU400 versions 6.5 K and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 6.6.0 or latest
BehobenPCU400 versions 6.5 K and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 6.6.0 or latest
BehobenPCU400 versions 6.5 K and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 6.6.0 or latest
BehobenPCU400 versions 9.4.1 and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 9.4.2 or latest
BehobenPCU400 versions 9.4.1 and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 9.4.2 or latest
BehobenPCU400 versions 9.4.1 and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 9.4.2 or latest
BehobenPCU400 versions 9.4.1 and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 9.4.2 or latest
BehobenPCU400 versions 9.4.1 and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 9.4.2 or latest
BehobenPCU400 versions 9.4.1 and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 9.4.2 or latest
BehobenPCU400 versions 9.4.1 and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 9.4.2 or latest
BehobenPCU400 versions 9.4.1 and below
If IEC62351-3 secure for IEC104/DNP3 is used, then update to version 9.4.2 or latest

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan