PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-4518 Hitachi Energy CVE debrief

CVE-2023-4518 is a medium-severity availability issue in Hitachi Energy’s Relion 670/650/SAM600-IO family. According to the CISA CSAF advisory, the device’s IEC 61850 GOOSE input validation can accept out-of-range values that, when processed by the IED, may cause a reboot. The advisory notes that exploitation requires GOOSE receiving blocks to be configured, and the published CVSS vector reflects a high availability impact with no confidentiality or integrity impact.

Vendor
Hitachi Energy
Product
Relion 670
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2023-11-28
Original CVE updated
2026-02-26
Advisory published
2023-11-28
Advisory updated
2026-02-26

Who should care

Utilities, substation operators, and OT security teams running Hitachi Energy Relion 670, Relion 650, or SAM600-IO devices. Network defenders responsible for IEC 61850 environments should also care, especially where GOOSE receiving blocks are enabled.

Technical summary

CISA’s advisory for CVE-2023-4518 describes an input-validation flaw in IEC 61850 GOOSE message handling. If a device receives out-of-range values and the relevant GOOSE receiving blocks are configured, the IED can reboot. The advisory maps the issue to CWE-1284 and rates it CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5).

Defensive priority

Moderate to high for OT environments where relay availability is critical. The issue is not a remote code execution problem, but a reboot of protective equipment can still disrupt operations and availability.

Recommended defensive actions

  • Update affected systems to the vendor-fixed releases listed in the advisory: 2.0.0.14, 2.1.0.6, 2.2.1.9, 2.2.2.6, 2.2.3.7, 2.2.4.4, or 2.2.5.6, as applicable to the installed product line.
  • For Relion 670 series version 2.2.0, apply the vendor’s general mitigation factors as directed by the advisory.
  • Review whether GOOSE receiving blocks are configured on exposed devices and limit that configuration to what is operationally necessary.
  • Apply ICS defensive-in-depth measures such as network segmentation, strict change control, and monitoring for unexpected relay reboots.
  • Use vendor and CISA ICS recommended practices to validate OT asset exposure and harden engineering workstations and control networks.
  • Track the latest vendor and CISA advisories for any additional remediation guidance or revision history updates.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory source item for ICSA-25-133-02, which references Hitachi Energy PSIRT advisory 8DBD000170 and lists affected Relion 670/650/SAM600-IO versions, fixed releases, and the condition that GOOSE receiving blocks must be configured for exploitation. The CVE published date used here is 2023-11-28; later advisory revision dates are treated only as update context.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-4518 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-4518

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-4518 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-4518

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-133-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.