A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products.
An attacker could exploit the vulnerability by using a specially crafted message sequence, to force the IEC 61850 MMS-server communication stack, to stop accepting new MMS-client connections.
Already existing/established client-server connections are not affected.
List of affected CPEs:
cpe:2.3:o:hitachienergy:fox61xtego1:r15b08::::::: cpe:2.3:o:hitachienergy:fox61xtego1:r2a163::::::: cpe:2.3:o:hitachienergy:fox61xtego1:r2a16::::::: cpe:2.3:o:hitachienergy:fox61xtego1:r1e01::::::: cpe:2.3:o:hitachienergy:fox61xtego1:r1d02::::::: cpe:2.3:o:hitachienergy:fox61xtego1:r1c07::::::: cpe:2.3:o:hitachienergy:fox61xtego1:r1b02::::::: cpe:2.3:a:hitachienergy:gms600:1.3.0::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:1.1.::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:1.5.::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:1.6.0::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:1.6.0.1::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:1.7.0::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:1.7.2::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:1.8.0::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:2.0.::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:2.1.0.4::::::: cpe:2.3:a:hitachienergy:itt600saexplorer:2.1.0.5::::::: cpe:2.3:a:hitachienergy:microscadaxsys600:10::::::: cpe:2.3:a:hitachienergy:microscadaxsys600:10.::::::: cpe:2.3:a:hitachienergy:microscadaxsys600:10.2::::::: cpe:2.3:a:hitachienergy:microscadaxsys600:10.2.1::::::: cpe:2.3:a:hitachienergy:microscadaxsys600:10.3::::::: cpe:2.3:a:hitachienergy:microscadaxsys600:10.3.1::::::: cpe:2.3:a:hitachienergy:microscadaxsys600:10.4::::::: cpe:2.3:a:hitachienergy:microscadaxsys600:10.4.1::::::: cpe:2.3:a:hitachienergy:mms:2.2.3::::::: cpe:2.3:a:hitachienergy:pwc600:1.0::::::: cpe:2.3:a:hitachienergy:pwc600:1.1::::::: cpe:2.3:a:hitachienergy:pwc600:1.2::::::: cpe:2.3:o:hitachienergy:reb500:7:::::::: cpe:2.3:o:hitachienergy:reb500:8::::::: cpe:2.3:o:hitachienergy:relion670:1.2.::::::: cpe:2.3:o:hitachienergy:relion670:2.0.::::::: cpe:2.3:o:hitachienergy:relion650:1.1.::::::: cpe:2.3:o:hitachienergy:relion650:1.3.::::::: cpe:2.3:o:hitachienergy:relion650:2.1.::::::: cpe:2.3:o:hitachienergy:relion670:2.1.::::::: cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.1::::::: cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.5::::::: cpe:2.3:o:hitachienergy:relion670:2.2.::::::: cpe:2.3:o:hitachienergy:relion650:2.2.::::::: cpe:2.3:o:hitachienergy:rtu500cmu:12..::::::: cpe:2.3:a:hitachienergy:rtu500cmu:13..::::::: cpe:2.3:a:hitachienergy:txperthubcoretec4:2.::::::: cpe:2.3:a:hitachienergy:txperthubcoretec4:3.0::::::: cpe:2.3:a:hitachienergy:txperthubcoretec5:3.0:::::::
A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-5 and the CMU contains the license feature ‘Advanced security’ which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation which eventually if exploited causes an internal buffer to overflow in the HCI IEC 60870-5-104 function.
A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-3. After session resumption interval is expired an RTU500 initiated update of session parameters causes an unexpected restart due to a stack overflow.