CVE-2024-28757 Hitachi Energy CVE debrief

Who should care

OT/ICS operators, control engineers, and security teams responsible for Hitachi Energy RTU500 deployments—especially systems running CMU Firmware 13.7.1 through 13.7.6 and exposing IEC 61850 client/server functionality to authenticated users.

Technical summary

The advisory describes a libexpat-related memory mismanagement condition in the IEC 61850 client and server components of the RTU500 product series. A successful trigger requires an authenticated and authorized malicious user to supply crafted XML input. The stated outcome is a reboot of RTU500, so the primary security impact is availability loss. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) aligns with a network-reachable, low-complexity, low-privilege, no-user-interaction availability issue. Hitachi Energy’s listed remediation is to update CMU Firmware 13.7.1 through 13.7.6 to 13.7.7 and follow the associated mitigation guidance.

Defensive priority

Medium-high. The vulnerability is not described as remotely unauthenticated, but it can still interrupt industrial operations by rebooting affected RTU500 systems. Prioritize if the affected firmware range is deployed in production or where IEC 61850 interfaces are reachable by authorized users.

Recommended defensive actions

• Upgrade RTU500 series CMU Firmware version 13.7.1 through 13.7.6 to CMU Firmware version 13.7.7, as specified by Hitachi Energy.
• Review and apply the general mitigation factors/workarounds referenced in the vendor advisory for CVE-2024-28757.
• Limit and monitor authenticated access to IEC 61850 client/server functions and XML-bearing workflows on affected RTU500 systems.
• Validate operational resilience, including failover and reboot recovery procedures, before and after remediation.

Evidence notes

This debrief is based on the CISA CSAF advisory for ICSA-25-259-02 and the CVE record metadata supplied in the source corpus. The core claims used here are limited to the advisory description: libexpat use in RTU500 IEC 61850 client/server components, crafted XML input from an authenticated and authorized malicious user, memory mismanagement, and possible reboot. Remediation details are taken from the advisory’s listed mitigation entries, including the CMU Firmware 13.7.7 update path for versions 13.7.1 through 13.7.6. No exploitation evidence, KEV listing, or threat-campaign attribution was supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.