Vulnerability · Published Apr 30, 2024 · Assigned by Hitachi Energy
CVE-2024-2617
High 7.2
In plain English
A high-severity security flaw in RTU500 series CMU firmware from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update, if secure update feature was not enabled on all CMUs of a RTU500. If a malicious actor successfully exploits this vulnerability, they could use it to update the RTU500 with unsigned firmware.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | RTU500 series CMU firmware | 13.2.1 – through 13.2.713.4.1 – through 13.4.413.5.1 – through 13.5.3 |
Weakness: CWE-358 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H