csaf_certbund - wid-sec-w-2023-3187

WID-SEC-W-2023-3187

Vulnerability from csaf_certbund - Published: 2023-12-19 23:00 - Updated: 2023-12-19 23:00

Summary

Hitachi Energy RTU500: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Die RTU500-Serie ist eine Produktfamilie von Remote Terminal Units, die Informationen aus dem physikalischen Stromnetz in ein SCADA-System bringt.

Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Hitachi Energy RTU500 ausnutzen, um die Identität des Dienstes zu fälschen oder einen Denial of Servie zu verursachen.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die RTU500-Serie ist eine Produktfamilie von Remote Terminal Units, die Informationen aus dem physikalischen Stromnetz in ein SCADA-System bringt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Hitachi Energy RTU500 ausnutzen, um die Identit\u00e4t des Dienstes zu f\u00e4lschen oder einen Denial of Servie zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-3187 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3187.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-3187 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3187"
      },
      {
        "category": "external",
        "summary": "Hitachi Cybersecurity Advisory vom 2023-12-19",
        "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152\u0026languageCode=en\u0026Preview=true"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-12-19",
        "url": "https://github.com/advisories/GHSA-r8hg-9v6r-2mq2"
      },
      {
        "category": "external",
        "summary": "Hitachi Cybersecurity Advisory vom 2023-12-19",
        "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184\u0026languageCode=en\u0026Preview=true"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-12-19",
        "url": "https://github.com/advisories/GHSA-x25m-g22v-6hgf"
      }
    ],
    "source_lang": "en-US",
    "title": "Hitachi Energy RTU500: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-12-19T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:03:01.382+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-3187",
      "initial_release_date": "2023-12-19T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-12-19T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.0.15",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.0.15",
                  "product_id": "T031450",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.0.15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.2.12",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.2.12",
                  "product_id": "T031451",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.2.12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.4.12",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.4.12",
                  "product_id": "T031452",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.4.12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.6.10",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.6.10",
                  "product_id": "T031453",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.6.10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 12.7.7",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 12.7.7",
                  "product_id": "T031454",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:12.7.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 13.2.7",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 13.2.7",
                  "product_id": "T031455",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:13.2.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 13.4.4",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 13.4.4",
                  "product_id": "T031457",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:13.4.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 Scripting interface \u003c 1.2.1",
                "product": {
                  "name": "Hitachi Energy RTU500 Scripting interface \u003c 1.2.1",
                  "product_id": "T031763",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:scripting_interface__1.2.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Hitachi Energy RTU500 \u003c 13.5.2",
                "product": {
                  "name": "Hitachi Energy RTU500 \u003c 13.5.2",
                  "product_id": "T031764",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:rtu500:13.5.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "RTU500"
          }
        ],
        "category": "vendor",
        "name": "Hitachi Energy"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-1514",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Hitachi Energy RTU500. Das Problem besteht in der Komponente \"Scripting-Schnittstelle\". Der Client validiert die Parameter des vorgelegten Zertifikats nicht ordnungsgem\u00e4\u00df, so dass nicht \u00fcberpr\u00fcft werden kann, ob der Remote-Dienst vertrauensw\u00fcrdig ist. Ein Angreifer kann diese Schwachstelle ausnutzen, um die Identit\u00e4t des Dienstes f\u00e4lschen und in der Folge \u00fcber die RTU500 Scripting-Schnittstelle initiierte Nachrichten abfangen."
        }
      ],
      "release_date": "2023-12-19T23:00:00.000+00:00",
      "title": "CVE-2023-1514"
    },
    {
      "cve": "CVE-2023-6711",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Hitachi Energy RTU500. Speziell gestaltete Nachrichten werden nicht sachgem\u00e4\u00df validiert, was einen Puffer\u00fcberlauf und einen Neustart des Ger\u00e4tes verursachen kann. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Servie zu verursachen."
        }
      ],
      "release_date": "2023-12-19T23:00:00.000+00:00",
      "title": "CVE-2023-6711"
    }
  ]
}

CVE-2023-6711 (GCVE-0-2023-6711)

Vulnerability from cvelistv5 – Published: 2023-12-19 14:53 – Updated: 2024-09-25 08:43

Summary

Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Hitachi Energy

References

URL

Tags

https://publisher.hitachienergy.com/preview?Docum…

vendor-advisory

Impacted products

	Vendor	Product	Version
	Hitachi Energy	RTU500 series CMU Firmware	Affected: 12.0.1 , ≤ 12.0.14 (custom) Affected: 12.2.1 , ≤ 12.2.11 (custom) Affected: 12.4.1 , ≤ 12.4.11 (custom) Affected: 12.6.1 , ≤ 12.6.9 (custom) Affected: 12.7.1 , ≤ 12.7.6 (custom) Affected: 13.2.1 , ≤ 13.2.6 (custom) Affected: 13.4.1 , ≤ 13.4.3 (custom) Affected: 13.5.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:35:14.886Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184\u0026languageCode=en\u0026Preview=true"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RTU500 series CMU Firmware",
          "vendor": "Hitachi Energy",
          "versions": [
            {
              "lessThanOrEqual": "12.0.14",
              "status": "affected",
              "version": "12.0.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.2.11",
              "status": "affected",
              "version": "12.2.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.4.11",
              "status": "affected",
              "version": "12.4.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.6.9",
              "status": "affected",
              "version": "12.6.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.7.6",
              "status": "affected",
              "version": "12.7.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.2.6",
              "status": "affected",
              "version": "13.2.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "13.4.3",
              "status": "affected",
              "version": "13.4.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "13.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU."
            }
          ],
          "value": "Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-25T08:43:52.208Z",
        "orgId": "e383dce4-0c27-4495-91c4-0db157728d17",
        "shortName": "Hitachi Energy"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184\u0026languageCode=en\u0026Preview=true"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17",
    "assignerShortName": "Hitachi Energy",
    "cveId": "CVE-2023-6711",
    "datePublished": "2023-12-19T14:53:44.658Z",
    "dateReserved": "2023-12-12T06:25:59.268Z",
    "dateUpdated": "2024-09-25T08:43:52.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1514 (GCVE-0-2023-1514)

Vulnerability from cvelistv5 – Published: 2023-12-19 14:22 – Updated: 2024-08-02 05:49

Summary

A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

Hitachi Energy

References

URL

Tags

https://publisher.hitachienergy.com/preview?Docum…

vendor-advisory

Impacted products

	Vendor	Product	Version
	Hitachi Energy	RTU500 Scripting Interface	Affected: 1.0.1.30 Affected: 1.0.2 Affected: 1.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:49:11.678Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152\u0026languageCode=en\u0026Preview=true"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RTU500 Scripting Interface",
          "vendor": "Hitachi Energy",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.1.30"
            },
            {
              "status": "affected",
              "version": "1.0.2"
            },
            {
              "status": "affected",
              "version": "1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted\u0026nbsp;and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface."
            }
          ],
          "value": "A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted\u00a0and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-151",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-151 Identity Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-19T14:22:37.619Z",
        "orgId": "e383dce4-0c27-4495-91c4-0db157728d17",
        "shortName": "Hitachi Energy"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152\u0026languageCode=en\u0026Preview=true"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17",
    "assignerShortName": "Hitachi Energy",
    "cveId": "CVE-2023-1514",
    "datePublished": "2023-12-19T14:22:37.619Z",
    "dateReserved": "2023-03-20T12:32:04.973Z",
    "dateUpdated": "2024-08-02T05:49:11.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2023-3187

CVE-2023-6711 (GCVE-0-2023-6711)

CVE-2023-1514 (GCVE-0-2023-1514)

Tags

Sightings

Nomenclature