Hitachi Energy RTU500 series Stack-Based Buffer Overflow (CVE-2022-2502)

high Tenable OT Security Plugin ID 501614

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-5 and the CMU contains the license feature Advanced security' which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation which eventually if exploited causes an internal buffer to overflow in the HCI IEC 60870-5-104 function.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Hitachi Energy recommends users update to CMU Firmware versions 13.3.3 or 13.4.1.

The reported vulnerabilities affect only the RTU500 series with HCI IEC 60870-5-104 and IEC62351-5 or IEC 62351-5 configured and enabled. A possible mitigation is to disable the HCI IEC 60870-5-104 function or its IEC 62351-3 and IEC 62351-5 features if they are not used. By default, the HCI IEC 60870-5-104 and its IEC 62351-3 or IEC 62351-5 support are disabled.

Hitachi Energy recommends the following general mitigations:

- Recommended security practices and firewall configurations can help protect a process control network from attacks originating from outside the network.
- Physically protect process control systems from direct access by unauthorized personnel.
- Ensure process control systems have no direct connections to the internet and are separated from other networks via a firewall system with minimal exposed ports.
- Do not use process control systems for internet surfing, instant messaging, or receiving emails.
- Scan portable computers and removable storage media for malware prior connection to a control system.
- Enforce proper password policies and processes.

For more information, see Hitachi Energy’s Security Advisory: 8DBD000121.

Plugin Details

Severity: High

ID: 501614

File Name: tenable_ot_abb_CVE-2022-2502.nasl

Version: 1.3

Type: remote

Family: Tenable.ot

Published: 9/6/2023

Updated: 2/14/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2022-2502

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:hitachienergy:rtu500_firmware:13.3.1, cpe:/o:hitachienergy:rtu500_firmware:13.3.2

Required KB Items: Tenable.ot/ABB

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2023

Vulnerability Publication Date: 7/26/2023

Reference Information

CVE: CVE-2022-2502

CWE: 20

Detections

Analytics