ABB RTU500 Series, AFS series and M2M Gateway Type Confusion in embedded OpenSSL (CVE-2023-0286)

high Tenable OT Security Plugin ID 501746

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability exists in the OpenSSL that affects the RTU500 Series product versions listed below.

RTU500 series CMU Firmware versions 12.0.1 – 12.0.15 12.2.1 – 12.2.12 12.4.1 – 12.4.12 12.6.1 – 12.6.9 12.7.1 – 12.7.6 13.2.1 – 13.2.6 13.3.1 – 13.3.3 13.4.2

M2M Gateway ARM600: Versions 4.1.2 up to and including 5.0.3 M2M Gateway SW: Versions 5.0.1 up to and including 5.0.3

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE.
This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Hitachi Energy has released the following mitigations/fixes:

- AFS650: Update to AFS 650 firmware version 9.1.10
- AFS660-C, AFS665-B, AFS670-V2: Update to AFS 66x firmware version 7.1.08
- AFS670/675/677, AFR677: Update to AFS/AFR 67x firmware version 9.1.10

In addition, recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

For more information, see Hitachi Energy's Cybersecurity Advisory.

Plugin Details

Severity: High

ID: 501746

Version: 1.4

Type: remote

Family: Tenable.ot

Published: 9/29/2023

Updated: 11/13/2025

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2023-0286

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:abb:afs650, cpe:/o:abb:afs675, cpe:/o:hitachienergy:rtu500_firmware, cpe:/o:abb:arm600_firmware, cpe:/o:abb:afs677, cpe:/o:abb:afs670-v2, cpe:/o:abb:afs670, cpe:/o:abb:afs665-b, cpe:/o:abb:sw_firmware, cpe:/o:abb:afs660-c, cpe:/o:abb:afr677

Required KB Items: Tenable.ot/ABB

Exploit Ease: No known exploits are available

Patch Publication Date: 2/8/2023

Vulnerability Publication Date: 2/8/2023

Reference Information

CVE: CVE-2023-0286

CWE: 843

ICSA: 23-143-02, 24-205-02, 25-105-08

Detections

Analytics