title: Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series
description: A vulnerability in the HCI Modbus TCP COMPONENT of Hitachi Energy RTU500 series CMU Firmware that is caused by the validation error in the length information carried in MBAP header allows an ATTACKER to reboot the device by sending a special crafted message. This issue affects: Hitachi Energy RTU500 series CMU Firmware 12.0.*; 12.2.*; 12.4.*; 12.6.*; 12.7.*; 13.2.*.
problem types: CWE-20 Improper Input Validation
affected:
{
product: RTU500 series CMU Firmware
vendor: Hitachi Energy
versions:
status: affected, version: 12.0.*
status: affected, version: 12.2.*
status: affected, version: 12.4.*
status: affected, version: 12.6.*
status: affected, version: 12.7.*
status: affected, version: 13.2.*
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: Remediation available, see the advisory for details.