CVE-2023-6711

highpriority · track · 30EPSS 0.007 · 52 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.67% (52nd) EPSS
CVSS 7.5 · high
Is it mine?
41 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedRTU500 series CMU Firmwarecisa_csaf_ot

    Hitachi Energy RTU500 series CMU Firmware 12.0.15

  • MitigationRTU500 series CMU Firmwarecisa_csaf_ot

    Hitachi Energy recommends that customers follow the "Remote Terminal Units Security Deployment Guideline", as well as to apply mitigation as described below.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US
v3.15.9mediumAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · cybersecurity@hitachienergy.comexploitability 2.2 · impact 3.6
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-120USprimaryCWE-120USCWE-20US
04

affected products (41)

Products and version ranges known to be affected.

showing 20 of 41
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2023-3187Hitachi Energy RTU500: Mehrere SchwachstellenDeutsch2023-12-19csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Hitachi Energy RTU500 ausnutzen, um die Identität des Dienstes zu fälschen oder einen Denial of Servie zu verursachen.

  • ICSA-24-354-01Hitachi Energy RTU500 series CMU2024-12-19icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otcert_bundNVDCVE.orgMITRE
published 2023-12-19modified 2026-06-17
09

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan