CVE-2022-4450 Hitachi Energy CVE debrief

Who should care

Operators, maintainers, and integrators using Hitachi Energy PCU400 or PCULogger should care most, especially if deployments use IEC62351-3 secure workflows or accept PEM files from external or less-trusted sources. Availability-sensitive ICS environments should prioritize this because the flaw can crash parsing components.

Technical summary

The advisory maps CVE-2022-4450 to a double-free condition in OpenSSL's PEM_read_bio_ex() path. A PEM file with zero bytes of payload can cause the function to fail while leaving the header argument pointing to already-freed memory; if the caller then frees it, a double free occurs. The record states that PEM_read_bio() and PEM_read() wrappers, as well as indirect callers such as PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file(), are affected in contexts where they free the returned header on failure. For Hitachi Energy, the affected products listed are PCU400 versions 6.5 K and below, PCU400 versions 9.4.1 and below, and PCULogger versions 1.1.0 and below. The supplied CVSS vector is 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

High — prioritize patching where these products may parse untrusted PEM files or support external import paths, because the documented outcome is process crash and service disruption.

Recommended defensive actions

• Upgrade PCU400 versions 6.5 K and below to version 6.6.0 or later if IEC62351-3 secure for IEC104/DNP3 is used.
• Upgrade PCU400 versions 9.4.1 and below to version 9.4.2 or later if IEC62351-3 secure for IEC104/DNP3 is used.
• For PCULogger versions 1.1.0 and below, plan migration to version 1.2.0 when available; the advisory says it is compatible with PCU400 9.4.2 and later.
• Restrict and validate any workflow that accepts PEM files from untrusted sources, and monitor affected systems for crashes or abnormal restarts while remediation is underway.
• Apply CISA ICS recommended practices to reduce exposure and improve resilience in industrial environments.

Evidence notes

The source corpus is the CISA CSAF advisory ICSA-25-065-01 for Hitachi Energy PCU400, published and modified on 2025-02-25, with the same date used for the supplied CVE record context. The advisory text attributes the issue to OpenSSL PEM parsing, describes the likely impact as a crash/denial of service, and lists PCU400 and PCULogger affected versions and remediations. The enrichment data marks the item as not KEV-listed in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.