CVE-2023-5768 Hitachi Energy CVE debrief

Who should care

OT/ICS operators, control-system administrators, maintenance teams, and asset owners responsible for RTU500 series CMU firmware or any exposed RTU500 webserver interface.

Technical summary

The advisory describes a webserver input-validation problem in RTU500 series CMU firmware. Because user input is not sanitized correctly, an attacker can cause cross-site scripting in the web interface. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network reachability and required user interaction, with low confidentiality and integrity impact and no availability impact. Affected firmware ranges include 12.0.1-12.0.14, 12.2.1-12.2.11, 12.4.1-12.4.11, 12.6.1-12.6.9, 12.7.1-12.7.6, 13.2.1-13.2.6, and 13.4.1-13.4.3.

Defensive priority

Medium: prioritize remediation on any RTU500 deployment with web management access, especially where the interface is reachable beyond a tightly controlled admin network.

Recommended defensive actions

• Upgrade each affected RTU500 series CMU firmware branch to the vendor-fixed version: 12.0.15, 12.2.12, 12.4.12, 12.6.10, 12.7.7, 13.2.7, 13.4.4, or 13.5.1 as applicable.
• Restrict access to the RTU500 webserver to trusted administrative networks or VPN paths only; avoid direct exposure where possible.
• Apply CISA ICS defense-in-depth guidance, including network segmentation, least privilege for administrative users, and monitoring of control-system web interfaces.
• Review logs and change records for suspicious web requests or unexpected script-like input associated with the RTU500 interface.
• Confirm asset inventory coverage so every affected firmware branch is identified and upgraded consistently across sites.

Evidence notes

The supplied CISA CSAF advisory for CVE-2023-5768 states that the RTU500 series webserver is affected by cross-site scripting due to improperly sanitized user input. The advisory metadata provides CVSS 3.1 score 5.4 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. Revision history in the source shows the initial publication on 2023-11-28 and subsequent updates through 2024-12-18, including additions of fixed firmware versions for the affected series. The corpus also includes the vendor advisory reference, the CISA advisory page, and the NVD record; no KEV listing is supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.