Republished vendor advisory. This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000220 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…
Support: For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.
General Mitigation Factors: Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
Credit: Hitachi Energy Internal Team
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2023-2953 | CWE-476 NULL Pointer Dereference | 7.5 High |
CVE-2023-2953 A vulnerability has been identified in the openLDAP library used in Central Account Management (CAM) client. This issue can lead to a Denial of Service (DoS) condition when a specially crafted request may cause a null pointer to deference, resulting in affected CMU to automatically recovering itself by rebooting. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: Update to CMU Firmware version 12.7.8 Mitigation: Follow general mitigation factors /workarounds Vendor fix: Update to CMU Firmware version 13.5.4 Affected, fixed & timelineAffected:
Mitigation: Follow general mitigation factors/workarounds. Vendor fix: Update to CMU Firmware version 13.6.3 Vendor fix: Update to CMU Firmware version 13.7.7 |
| CVE-2024-28757 | CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | 6.5 Medium |
CVE-2024-28757 A vulnerability has been identified in libexpat library used in the IEC 61850 client and server components of the RTU500 product series. An authenticated and authorized malicious user could load a crafted XML input which may lead to a memory mismanagement potentially causing RTU500 to reboot. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: Update to CMU Firmware version 13.7.7 Mitigation: Follow general mitigation factors/workarounds. Affected, fixed & timelineAffected:
|
| CVE-2024-45490 | CWE-611 Improper Restriction of XML External Entity Reference | 6.5 Medium |
CVE-2024-45490 A vulnerability has been identified in the libexpat library used in IEC 61850 client and server components of the RTU500 product series. An authenticated and authorized malicious user could load a crafted XML input which may lead to memory mismanagement potentially causing RTU500 to reboot. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: Update to CMU Firmware version 13.7.7 Affected, fixed & timelineAffected:
|
| CVE-2024-45491 | CWE-122 Heap-based Buffer Overflow | 6.5 Medium |
CVE-2024-45491 A vulnerability has been identified in libexpat library used in the IEC 61850 client and server components of the RTU500 product series. An authenticated and authorized malicious user could load a crafted XML input which may lead to heap corruption potentially causing RTU500 to reboot. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: Update to CMU Firmware version 13.7.7 Mitigation: Follow general mitigation factors/workarounds. Affected, fixed & timelineAffected:
|
| CVE-2024-45492 | CWE-190 Integer Overflow or Wraparound | 6.5 Medium |
CVE-2024-45492 A vulnerability has been identified in libexpat library used in the IEC 61850 client and server components of the RTU500 product series. An authenticated and authorized malicious user could load a crafted XML input which leads to an integer overflow potentially causing RTU500 to reboot. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: Update to CMU Firmware version 13.7.7 Mitigation: Follow general mitigation factors/workarounds. Affected, fixed & timelineAffected:
|
| CVE-2025-6021 | CWE-121 Stack-based Buffer Overflow | 6.5 Medium |
CVE-2025-6021 A vulnerability exists in libxml library used by RTU500 Web server functionality. An authenticated and authorized malicious user could send a crafted XML message which may lead to buffer overflow potentially causing RTU500 to reboot. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: Update to CMU Firmware version 12.7.8 Mitigation: Follow general mitigation factors/workarounds. Vendor fix: Update to CMU Firmware version 13.5.4 Affected, fixed & timelineAffected:
Vendor fix: Update to CMU Firmware version 13.6.3 Vendor fix: Update to CMU Firmware version 13.7.7 |
| CVE-2025-39203 | CWE-354 Improper Validation of Integrity Check Value | 4.3 Medium |
CVE-2025-39203 A vulnerability exists in the IEC 61850 protocol of the RTU500 product series. An IEC 61850-8 crafted message content from a device (e.g. an IED) or remote system can cause a Denial of Service (DoS) resulting in disconnection of the device to the RTU500 until next reboot. CISA SSVC — Exploitation: None · Automatable: No Vendor fix: Update to CMU Firmware version 12.7.8 Mitigation: Follow general mitigation factors/ workarounds. Vendor fix: Update to CMU Firmware version 13.7.7 Affected, fixed & timelineAffected:
Mitigation: Follow General Mitigation Factors/Workarounds. Vendor fix: Update to CMU Firmware version 13.5.4 Mitigation: Follow general mitigation factors/workarounds. Vendor fix: Update to CMU Firmware version 13.6.3 |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-45490 | 9.8 Critical | n/a n/a An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. |
| CVE-2023-2953 | 7.5 High | n/a openldap A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. |
| CVE-2024-28757 | 7.5 High | n/a n/a libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCrea… |
| CVE-2025-6021 | 7.5 High | — A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. … |
| CVE-2024-45491 | 7.3 High | n/a n/a An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT… |
| CVE-2024-45492 | 7.3 High | n/a n/a An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (wh… |
| CVE-2025-39203 | 6.5 Medium | Hitachi Energy MicroSCADA X SYS600 A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can caus… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.