Log in Start free

Vulnerability · Published Mar 25, 2025 · Assigned by Hitachi Energy

CVE-2024-10037

Medium 4.4

In plain English

A medium-severity null pointer dereference in RTU500 from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection. An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability. The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.

Affected products (as reported)

VendorProductVersions
Hitachi Energy RTU500 12.0.1 – through 12.0.1412.2.1 – through 12.2.1212.4.1 – through 12.4.1112.6.1 – through 12.6.1012.7.1 – through 12.7.713.2.1 – through 13.2.713.4.1 – through 13.4.413.5.1 – through 13.5.3

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

References