Riskcovery

CVE-2022-28613

Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series

State
Published
Severity
7.5 High
Published
May 2, 2022
Updated
Sep 25, 2024
Reserved
Apr 4, 2022

Read the record on cve.org

Description

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HHitachi Energy

Weaknesses

  • CWE-1284 Improper Validation of Specified Quantity in Input

Affected Products

ProductVersions
RTU500 series CMU FirmwareHitachi Energy
  • 12.0.*Affected
  • 12.2.*Affected
  • 12.4.*Affected
  • 12.6.*Affected
  • 12.7.*Affected
  • 13.2.*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.