Vulnerability · Published Nov 26, 2021 · Assigned by Hitachi Energy
CVE-2021-35533Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series
High 7.5
In plain English
A high-severity improper input validation in RTU500 series from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Official description
Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-5-104 function of Hitachi Energy RTU500 series allows an attacker to cause the receiving RTU500 CMU of which the BCI is enabled to reboot when receiving a specially crafted message. By default, BCI IEC 60870-5-104 function is disabled (not configured). This issue affects: Hitachi Energy RTU500 series CMU Firmware version 12.0.* (all versions); CMU Firmware version 12.2.* (all versions); CMU Firmware version 12.4.* (all versions).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | RTU500 series | CMU Firmware version 12.0 – through 12.0.*CMU Firmware version 12.2 – through 12.2.*CMU Firmware version 12.4 – through 12.4.* |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H