Hitachi ABB AFS Double Free (CVE-2022-4450)

high Tenable OT Security Plugin ID 503959

Synopsis

The remote OT asset is affected by a vulnerability.

Description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Hitachi Energy has released the following mitigations/fixes:

- AFS650: Update to AFS 650 firmware version 9.1.10
- AFS660-C, AFS665-B, AFS670-V2: Update to AFS 66x firmware version 7.1.08
- AFS670/675/677, AFR677: Update to AFS/AFR 67x firmware version 9.1.10

In addition, recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

For more information, see Hitachi Energy's Cybersecurity Advisory.

Plugin Details

Severity: High

ID: 503959

Version: 1.1

Type: remote

Family: Tenable.ot

Published: 11/13/2025

Updated: 11/13/2025

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: cpe:/o:abb:afs677, cpe:/o:abb:afs675, cpe:/o:abb:afs665-b, cpe:/o:abb:afs650, cpe:/o:abb:afs670-v2, cpe:/o:abb:afs660-c, cpe:/o:abb:afr677, cpe:/o:abb:afs670

Required KB Items: Tenable.ot/ABB

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2024

Vulnerability Publication Date: 6/25/2024

Reference Information

CVE: CVE-2022-4450

CWE: 415

ICSA: icsa-24-205-02

Detections

Analytics