description: Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: RTU500 series CMU Firmware
vendor: Hitachi Energy
versions:
lessThanOrEqual: 12.0.14, status: affected, version: 12.0.1, versionType: custom
lessThanOrEqual: 12.2.11, status: affected, version: 12.2.1, versionType: custom
lessThanOrEqual: 12.4.11, status: affected, version: 12.4.1, versionType: custom
lessThanOrEqual: 12.6.9, status: affected, version: 12.6.1, versionType: custom
lessThanOrEqual: 12.7.6, status: affected, version: 12.7.1, versionType: custom
lessThanOrEqual: 13.2.6, status: affected, version: 13.2.1, versionType: custom
lessThanOrEqual: 13.4.3, status: affected, version: 13.4.1, versionType: custom
status: affected, version: 13.5.1
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL