cnvd - cnvd-2025-02742

CNVD-2025-02742

Vulnerability from cnvd - Published: 2025-02-13

Title

Hitachi Energy RTU500 series CMU firmware缓冲区溢出漏洞

Description

RTU500是日本日立制作所（Hitachi）公司的一系列工控组件，主要用于工业控制系统。 Hitachi Energy RTU500 series CMU firmware HCI Modbus TCP功能存在缓冲区溢出漏洞，该漏洞源于启用并配置了HCI Modbus TCP，攻击者可利用漏洞通过向RTU500高速发送特制消息，导致HCI Modbus TCP功能中的内部堆栈溢出，并最终导致RTU500 CMU重新启动。

Severity

高

Patch Name

Hitachi Energy RTU500 series CMU firmware缓冲区溢出漏洞的补丁

Patch Description

Formal description

厂商已发布补丁修复漏洞，请广大用户及时下载更新： https://search.abb.com/library/Download.aspx?DocumentID=8DBD000111&LanguageCode=en&DocumentPartId=&Action=Launch

Reference

https://us-cert.cisa.gov/ics/advisories/icsa-22-235-07

Impacted products

Name
['Hitachi Energy RTU500 series CMU Firmware >=12.0.1.0，<=12.0.14.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.2.1.0，<=12.2.11.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.4.1.0，<=12.4.11.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.6.1.0，<=12.6.7.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.7.1.0，<=12.7.3.0', 'Hitachi Energy RTU500 series CMU Firmware >=13.2.1.0，<=13.2.4.0', 'Hitachi Energy RTU500 series CMU Firmware 13.3.1.0']

Name

['Hitachi Energy RTU500 series CMU Firmware >=12.0.1.0，<=12.0.14.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.2.1.0，<=12.2.11.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.4.1.0，<=12.4.11.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.6.1.0，<=12.6.7.0', 'Hitachi Energy RTU500 series CMU Firmware >=12.7.1.0，<=12.7.3.0', 'Hitachi Energy RTU500 series CMU Firmware >=13.2.1.0，<=13.2.4.0', 'Hitachi Energy RTU500 series CMU Firmware 13.3.1.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-2081"
    }
  },
  "description": "RTU500\u662f\u65e5\u672c\u65e5\u7acb\u5236\u4f5c\u6240\uff08Hitachi\uff09\u516c\u53f8\u7684\u4e00\u7cfb\u5217\u5de5\u63a7\u7ec4\u4ef6\uff0c\u4e3b\u8981\u7528\u4e8e\u5de5\u4e1a\u63a7\u5236\u7cfb\u7edf\u3002\n\nHitachi Energy RTU500 series CMU firmware HCI Modbus TCP\u529f\u80fd\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u542f\u7528\u5e76\u914d\u7f6e\u4e86HCI Modbus TCP\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u5411RTU500\u9ad8\u901f\u53d1\u9001\u7279\u5236\u6d88\u606f\uff0c\u5bfc\u81f4HCI Modbus TCP\u529f\u80fd\u4e2d\u7684\u5185\u90e8\u5806\u6808\u6ea2\u51fa\uff0c\u5e76\u6700\u7ec8\u5bfc\u81f4RTU500 CMU\u91cd\u65b0\u542f\u52a8\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u8865\u4e01\u4fee\u590d\u6f0f\u6d1e\uff0c\u8bf7\u5e7f\u5927\u7528\u6237\u53ca\u65f6\u4e0b\u8f7d\u66f4\u65b0\uff1a\r\nhttps://search.abb.com/library/Download.aspx?DocumentID=8DBD000111\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-02742",
  "openTime": "2025-02-13",
  "patchDescription": "RTU500\u662f\u65e5\u672c\u65e5\u7acb\u5236\u4f5c\u6240\uff08Hitachi\uff09\u516c\u53f8\u7684\u4e00\u7cfb\u5217\u5de5\u63a7\u7ec4\u4ef6\uff0c\u4e3b\u8981\u7528\u4e8e\u5de5\u4e1a\u63a7\u5236\u7cfb\u7edf\u3002\r\n\r\nHitachi Energy RTU500 series CMU firmware HCI Modbus TCP\u529f\u80fd\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u542f\u7528\u5e76\u914d\u7f6e\u4e86HCI Modbus TCP\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u5411RTU500\u9ad8\u901f\u53d1\u9001\u7279\u5236\u6d88\u606f\uff0c\u5bfc\u81f4HCI Modbus TCP\u529f\u80fd\u4e2d\u7684\u5185\u90e8\u5806\u6808\u6ea2\u51fa\uff0c\u5e76\u6700\u7ec8\u5bfc\u81f4RTU500 CMU\u91cd\u65b0\u542f\u52a8\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Hitachi Energy RTU500 series CMU firmware\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.0.1.0\uff0c\u003c=12.0.14.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.2.1.0\uff0c\u003c=12.2.11.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.4.1.0\uff0c\u003c=12.4.11.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.6.1.0\uff0c\u003c=12.6.7.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=12.7.1.0\uff0c\u003c=12.7.3.0",
      "Hitachi Energy RTU500 series CMU Firmware \u003e=13.2.1.0\uff0c\u003c=13.2.4.0",
      "Hitachi Energy RTU500 series CMU Firmware 13.3.1.0"
    ]
  },
  "referenceLink": "https://us-cert.cisa.gov/ics/advisories/icsa-22-235-07",
  "serverity": "\u9ad8",
  "submitTime": "2022-08-26",
  "title": "Hitachi Energy RTU500 series CMU firmware\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2022-2081 (GCVE-0-2022-2081)

Vulnerability from cvelistv5 – Published: 2024-01-04 09:15 – Updated: 2025-05-22 18:20

Summary

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

Hitachi Energy

References

URL

Tags

https://publisher.hitachienergy.com/preview?Docum…

Impacted products

	Vendor	Product	Version
	Hitachi Energy	RTU500 series CMU firmware	Affected: 12.0.1.0 , ≤ 12.0.13.0 (custom) Affected: 12.2.1.0 , ≤ 12.2.11.0 (custom) Affected: 12.4.1.0 , ≤ 12.4.11.0 (custom) Affected: 12.6.1.0 , ≤ 12.6.7.0 (custom) Affected: 12.7.1.0 , ≤ 12.7.3.0 (custom) Affected: 13.2.1.0 , ≤ 13.2.4.0 (custom) Affected: 13.3.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.276Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000111\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-04T17:17:18.805708Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T18:20:49.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RTU500 series CMU firmware",
          "vendor": "Hitachi Energy",
          "versions": [
            {
              "lessThanOrEqual": "12.0.13.0",
              "status": "affected",
              "version": "12.0.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.11.0",
              "status": "affected",
              "version": "12.2.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.11.0",
              "status": "affected",
              "version": "12.4.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.6.7.0",
              "status": "affected",
              "version": "12.6.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.7.3.0",
              "status": "affected",
              "version": "12.7.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.2.4.0",
              "status": "affected",
              "version": "13.2.1.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "13.3.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function."
            }
          ],
          "value": "A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-24T14:31:33.084Z",
        "orgId": "e383dce4-0c27-4495-91c4-0db157728d17",
        "shortName": "Hitachi Energy"
      },
      "references": [
        {
          "url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000111\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17",
    "assignerShortName": "Hitachi Energy",
    "cveId": "CVE-2022-2081",
    "datePublished": "2024-01-04T09:15:30.332Z",
    "dateReserved": "2022-06-14T12:21:15.314Z",
    "dateUpdated": "2025-05-22T18:20:49.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-02742

CVE-2022-2081 (GCVE-0-2022-2081)

Tags

Sightings

Nomenclature