CVE-2022-29492: A vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected conne ...
First published: Wed Sep 14 2022(Updated: )
Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected connection is left open. This issue affects: Hitachi Energy MicroSCADA Pro SYS600 version 9.4 FP2 Hotfix 4 and earlier versions Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
Credit: cybersecurity@hitachienergy.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachienergy Microscada X Sys600 | >=9.0<10.4 | |
| Hitachienergy Sys600 |
Remedy
Remediated in SYS600 10.4 For MicroSCADA Pro SYS600 - Upgrade to at least SYS600 version 10.4. For MicroSCADA X SYS600 - Update to at least SYS600 version 10.4.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-29492?
CVE-2022-29492 is an Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600 and MicroSCADA Pro SYS600.
How does CVE-2022-29492 affect the Hitachi Energy MicroSCADA X SYS600 and MicroSCADA Pro SYS600?
CVE-2022-29492 allows a denial of service (DoS) attack by causing a TCP connection to remain open when a malformed IEC 104 TCP packet is received.
What is the severity level of CVE-2022-29492?
CVE-2022-29492 has a severity level of 7.5 (high).
How can I mitigate CVE-2022-29492?
To mitigate CVE-2022-29492, it is recommended to apply the latest security patches or updates provided by Hitachi Energy for MicroSCADA X SYS600 and MicroSCADA Pro SYS600.
Where can I find more information about CVE-2022-29492?
More information about CVE-2022-29492 can be found at the following reference: [link](https://search.abb.com/library/Download.aspx?DocumentID=8DBD000106&LanguageCode=en&DocumentPartId=&Action=Launch).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/tags
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- vendor/hitachienergy
- canonical/hitachienergy microscada x sys600
- version/hitachienergy microscada x sys600/9.0
- canonical/hitachienergy sys600