Republished vendor advisory. This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000207 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…
Support: For additional information and support please contact your product provider or Hitachi Energy service organ-ization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.
General Mitigation Factors: Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
Credit: Hitachi Energy PSIRT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-1445 | CWE-820 Missing Synchronization | 7.5 High |
CVE-2025-1445 A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations, when IEC61850 communication is active. Precondition is that IEC61850 as client or server are configured using TLS on RTU500 device. It affects the CMU the IEC61850 stack is configured on. Mitigation: For all versions, apply General Mitigation Factors/Workarounds. Upgrade the system once remediated version in available, or apply general mitigation factors. Vendor fix: Update to CMU Firmware version 13.7.7 Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2024-12169 | CWE-410 Insufficient Resource Pool | 6.5 Medium |
CVE-2024-12169 A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to restart the affected CMU. This vulnerability only applies, if secure communication using IEC 62351-3 (TLS) is enabled. Mitigation: For all versions, apply General Mitigation Factors/Workarounds. Upgrade the system once remediated version in available, or apply general mitigation factors. Vendor fix: Update to CMU Firmware version 13.7.7 Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2024-11499 | CWE-476 NULL Pointer Dereference | 4.9 Medium |
CVE-2024-11499 Mitigation: For all versions, apply General Mitigation Factors/Workarounds. Upgrade the system once remediated version in available, or apply general mitigation factors. Vendor fix: Update to CMU Firmware version 13.5.4 Vendor fix: Update to CMU Firmware version 13.6.3 Affected, fixed & timelineAffected:
Fixed in:
Vendor fix: Update to CMU Firmware version 13.7.7 |
| CVE-2024-10037 | CWE-476 NULL Pointer Dereference | 4.4 Medium |
CVE-2024-10037 A vulnerability exists in the RTU500 web server com-ponent that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection. An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability. The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability. Mitigation: For all versions, apply General Mitigation Factors/Workarounds. Upgrade the system once remediated version in available, or apply general mitigation factors. Vendor fix: Update to CMU Firmware version 12.7.8 when available Vendor fix: Fixed in version 13.7.1. Update to CMU Firmware version 13.7.7 Affected, fixed & timelineAffected:
Fixed in:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-12169 | 8.7 High | Hitachi Energy RTU500 A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a s… |
| CVE-2025-1445 | 8.7 High | Hitachi Energy RTU500 A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS c… |
| CVE-2024-11499 | 6.9 Medium | Hitachi Energy RTU500 A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a … |
| CVE-2024-10037 | 5.9 Medium | Hitachi Energy RTU500 A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted mes… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.