Vulnerability-Lookup

WID-SEC-W-2023-3187

Vulnerability from csaf_certbund - Published: 2023-12-19 23:00 - Updated: 2023-12-19 23:00

Summary

Hitachi Energy RTU500: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Die RTU500-Serie ist eine Produktfamilie von Remote Terminal Units, die Informationen aus dem physikalischen Stromnetz in ein SCADA-System bringt.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Hitachi Energy RTU500 ausnutzen, um die Identität des Dienstes zu fälschen oder einen Denial of Servie zu verursachen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2023-1514

CVE-2023-6711

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://publisher.hitachienergy.com/preview?Docum…	external
https://github.com/advisories/GHSA-r8hg-9v6r-2mq2	external
https://publisher.hitachienergy.com/preview?Docum…	external
https://github.com/advisories/GHSA-x25m-g22v-6hgf	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die RTU500-Serie ist eine Produktfamilie von Remote Terminal Units, die Informationen aus dem physikalischen Stromnetz in ein SCADA-System bringt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Hitachi Energy RTU500 ausnutzen, um die Identit\u00e4t des Dienstes zu f\u00e4lschen oder einen Denial of Servie zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-3187 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3187.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-3187 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3187"
      },
      {
        "category": "external",
        "summary": "Hitachi Cybersecurity Advisory vom 2023-12-19",
        "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152\u0026languageCode=en\u0026Preview=true"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-12-19",
        "url": "https://github.com/advisories/GHSA-r8hg-9v6r-2mq2"
      },
      {
        "category": "external",
        "summary": "Hitachi Cybersecurity Advisory vom 2023-12-19",
        "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184\u0026languageCode=en\u0026Preview=true"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-12-19",
        "url": "https://github.com/advisories/GHSA-x25m-g22v-6hgf"
      }
    ],
    "source_lang": "en-US",
    "title": "Hitachi Energy RTU500: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-12-19T23:00:00.000+00:00",
      "generator": {
        "date": "2026-07-16T16:56:57.261+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2023-3187",
      "initial_release_date": "2023-12-19T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-12-19T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.0.15",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.0.15",
                  "product_id": "T031450",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.0.15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.2.12",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.2.12",
                  "product_id": "T031451",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.2.12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.4.12",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.4.12",
                  "product_id": "T031452",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.4.12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.6.10",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.6.10",
                  "product_id": "T031453",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.6.10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.7.7",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.7.7",
                  "product_id": "T031454",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.7.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 13.2.7",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 13.2.7",
                  "product_id": "T031455",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:13.2.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 13.4.4",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 13.4.4",
                  "product_id": "T031457",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:13.4.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 Scripting interface \u003c 1.2.1",
                "product": {
                  "name": "Hitachi Energy RTU500 Scripting interface \u003c 1.2.1",
                  "product_id": "T031763",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:scripting_interface__1.2.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 13.5.2",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 13.5.2",
                  "product_id": "T031764",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:13.5.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "RTU500"
          }
        ],
        "category": "vendor",
        "name": "Hitachi Energy"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-1514",
      "release_date": "2023-12-19T23:00:00.000+00:00",
      "title": "CVE-2023-1514"
    },
    {
      "cve": "CVE-2023-6711",
      "release_date": "2023-12-19T23:00:00.000+00:00",
      "title": "CVE-2023-6711"
    }
  ]
}

CVE-2023-1514 (GCVE-0-2023-1514)

Vulnerability from cvelistv5 – Published: 2023-12-19 14:22 – Updated: 2024-08-02 05:49

Summary

A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

Hitachi Energy Scorecard

References

1 reference

URL	Tags
https://publisher.hitachienergy.com/preview?Docum…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Hitachi Energy	RTU500 Scripting Interface	Affected: 1.0.1.30 Affected: 1.0.2 Affected: 1.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:49:11.678Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152\u0026languageCode=en\u0026Preview=true"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RTU500 Scripting Interface",
          "vendor": "Hitachi Energy",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.1.30"
            },
            {
              "status": "affected",
              "version": "1.0.2"
            },
            {
              "status": "affected",
              "version": "1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted\u0026nbsp;and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface."
            }
          ],
          "value": "A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted\u00a0and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-151",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-151 Identity Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-19T14:22:37.619Z",
        "orgId": "e383dce4-0c27-4495-91c4-0db157728d17",
        "shortName": "Hitachi Energy"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152\u0026languageCode=en\u0026Preview=true"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17",
    "assignerShortName": "Hitachi Energy",
    "cveId": "CVE-2023-1514",
    "datePublished": "2023-12-19T14:22:37.619Z",
    "dateReserved": "2023-03-20T12:32:04.973Z",
    "dateUpdated": "2024-08-02T05:49:11.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6711 (GCVE-0-2023-6711)

Vulnerability from cvelistv5 – Published: 2023-12-19 14:53 – Updated: 2024-09-25 08:43

Summary

Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Hitachi Energy Scorecard

References

1 reference

URL	Tags
https://publisher.hitachienergy.com/preview?Docum…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Hitachi Energy	RTU500 series CMU Firmware	Affected: 12.0.1 , ≤ 12.0.14 (custom) Affected: 12.2.1 , ≤ 12.2.11 (custom) Affected: 12.4.1 , ≤ 12.4.11 (custom) Affected: 12.6.1 , ≤ 12.6.9 (custom) Affected: 12.7.1 , ≤ 12.7.6 (custom) Affected: 13.2.1 , ≤ 13.2.6 (custom) Affected: 13.4.1 , ≤ 13.4.3 (custom) Affected: 13.5.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:35:14.886Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184\u0026languageCode=en\u0026Preview=true"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RTU500 series CMU Firmware",
          "vendor": "Hitachi Energy",
          "versions": [
            {
              "lessThanOrEqual": "12.0.14",
              "status": "affected",
              "version": "12.0.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.11",
              "status": "affected",
              "version": "12.2.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.11",
              "status": "affected",
              "version": "12.4.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.6.9",
              "status": "affected",
              "version": "12.6.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.7.6",
              "status": "affected",
              "version": "12.7.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.2.6",
              "status": "affected",
              "version": "13.2.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.4.3",
              "status": "affected",
              "version": "13.4.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "13.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU."
            }
          ],
          "value": "Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-25T08:43:52.208Z",
        "orgId": "e383dce4-0c27-4495-91c4-0db157728d17",
        "shortName": "Hitachi Energy"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184\u0026languageCode=en\u0026Preview=true"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17",
    "assignerShortName": "Hitachi Energy",
    "cveId": "CVE-2023-6711",
    "datePublished": "2023-12-19T14:53:44.658Z",
    "dateReserved": "2023-12-12T06:25:59.268Z",
    "dateUpdated": "2024-09-25T08:43:52.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2023-3187

CVE-2023-1514 (GCVE-0-2023-1514)

CVE-2023-6711 (GCVE-0-2023-6711)

Tags

Sightings

Nomenclature

Related by attack behaviour