Vulnerability · Published Mar 27, 2024 · Assigned by Hitachi Energy
CVE-2024-1531
High 8.2
In plain English
A high-severity unrestricted file upload in RTU500 series CMU firmware from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.4%top 60.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could print random memory content in the RTU500 system log, if an authorized user uploads a specially crafted stb-language file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | RTU500 series CMU firmware | 12.0.1 – through 12.0.1412.2.1 – through 12.2.1112.4.1 – through 12.4.1112.6.1 – through 12.6.912.7.1 – through 12.7.613.2.1 – through 13.2.613.4.1 – through 13.4.413.5.1 – through 13.5.3 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H