Republished vendor advisory. This CISA CSAF advisory was converted from Hitachi Energy PSIRT's CSAF advisory.
General Mitigation Factors/Workarounds: Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
Credit: Hitachi Energy PSIRT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2023-5767 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.0 Medium |
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to an RDT language file being improperly sanitized. Vendor fix: Update to the respective series fixed versions - 12.0.15, 12.2.12, 12.4.12, 12.6.10, 12.7.7, 13.2.7, 13.4.4 (or 13.5.1) Affected, fixed & timelineAffected:
|
| CVE-2023-5769 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5.9 Medium |
A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong received APDU frame layout may cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer with wrong length information of APDU or delayed reception of data octets. Only communication link of affected HCI IEC 60870-5-104 is blocked. If attack sequence stops the communication to the previously attacked link gets normal again. Vendor fix: Update to the respective series fixed versions - 12.0.15, 12.2.12, 12.4.12, 12.6.10, 12.7.7, 13.2.7, 13.4.4 (or 13.5.1) Affected, fixed & timelineAffected:
|
| CVE-2023-5768 | CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input | 5.4 Medium |
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to user input being improperly sanitized. Vendor fix: Update to the respective series fixed versions - 12.0.15, 12.2.12, 12.4.12, 12.6.10, 12.7.7, 13.2.7, 13.4.4 (or 13.5.1) Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2023-5767 | 6.0 Medium | Hitachi Energy RTU500 A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site s… |
| CVE-2023-5768 | 5.9 Medium | Hitachi Energy RTU500 series A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong received APDU fr… |
| CVE-2023-5769 | 5.4 Medium | Hitachi Energy RTU500 A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site s… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.