These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the stb-language file handling of Hitachi Energy RTU500 series CMU Firmware allows a malicious actor to print random memory content in the system log when an authorized user uploads a specially crafted stb-language file. The vulnerability was published on April 25, 2024, with a CVSS 3.1 score of 8.2 (HIGH). The attack vector is network-based with low complexity, requiring high privilege [truncated]
CVE-2024-2097 is a high-severity remote code execution vulnerability in Hitachi Energy MACH SCM and MACH SCM Tools, published on March 26, 2024. An authenticated attacker can craft a malicious LINQ query through the List control interface to execute arbitrary code on the SCM server. For SCM Tools installations, the same attack vector allows code execution on systems where SCMArchivedEventViewerTool is dep [truncated]
CVE-2024-0400 is a high-severity remote code execution vulnerability in Hitachi Energy MACH SCM, published 2024-03-26. An authenticated malicious client can bypass LINQ query validation to execute arbitrary code on the SCM server. Affected versions span 4.0 through 4.38.3; version 4.38.4 contains the vendor fix. No known exploitation in ransomware campaigns has been reported.
A certificate validation vulnerability in the Hitachi Energy RTU500 Scripting interface allows attackers to spoof service identity when TLS certificate parameters are not properly validated by the client. The flaw, published December 19, 2023, enables network-based attackers to impersonate legitimate services without authentication, potentially leading to man-in-the-middle attacks against industrial contr [truncated]
CVE-2023-5769 affects Hitachi Energy RTU500 series CMU firmware in the HCI IEC 60870-5-104 component. The advisory says incomplete or wrong received APDU frame layout, or delayed reception of APDU data octets, may cause endless blocking while incoming frames are read on the link layer. The impact is availability-only and limited to the affected communication link; if the attack sequence stops, the previou [truncated]
CVE-2023-5768 affects the Hitachi Energy RTU500 series webserver. Improperly sanitized user input can enable cross-site scripting when a user interacts with the web interface. The issue is rated CVSS 5.4 (Medium), and Hitachi Energy has published fixed firmware versions for each affected release family.
Hitachi Energy RTU500 series CMU firmware contains a webserver cross-site scripting issue caused by improper sanitization of an RDT language file. The advisory covers multiple 12.x and 13.x branches, and the vendor later expanded the fixed-version list through advisory revisions. Because the issue affects an OT web interface used for administration, it should be addressed promptly in any exposed or produc [truncated]
CVE-2023-4518 is a medium-severity availability issue in Hitachi Energy’s Relion 670/650/SAM600-IO family. According to the CISA CSAF advisory, the device’s IEC 61850 GOOSE input validation can accept out-of-range values that, when processed by the IED, may cause a reboot. The advisory notes that exploitation requires GOOSE receiving blocks to be configured, and the published CVSS vector reflects a high a [truncated]
CVE-2023-0217 is a denial-of-service issue tied to OpenSSL public-key checking behavior. In the supplied CISA CSAF advisory, Hitachi Energy maps the issue to PCU400 and PCULogger versions used with IEC62351-3 secure IEC104/DNP3 features. The practical risk is application crash if malformed DSA public keys from untrusted sources are processed.
CVE-2023-0216 is a denial-of-service issue affecting Hitachi Energy PCU400 and PCULogger when vulnerable OpenSSL PKCS7 parsing functions are used on malformed data. The advisory states that an invalid pointer dereference on read can crash the application. Hitachi Energy’s guidance focuses on updating affected releases used with IEC62351-3 secure IEC104/DNP3 deployments.
CVE-2023-0401 is a high-severity denial-of-service issue in the OpenSSL signature-verification path used by Hitachi Energy PCU400-related products. When PKCS7 signed or signedAndEnveloped data is verified and the requested hash algorithm is known to OpenSSL but its implementation is unavailable, digest initialization can fail and a missing return-value check can lead to NULL pointer dereference and a like [truncated]
CVE-2022-4203 affects Hitachi Energy PCU400 and PCULogger in X.509 certificate verification. The issue is a read buffer overrun in name constraint checking that occurs after certificate chain signature verification. In affected deployments, the flaw can lead to a crash and denial of service, and the advisory notes a theoretical risk of private memory disclosure, though no working disclosure exploit was kn [truncated]
CVE-2023-0215 is a use-after-free in OpenSSL's BIO_new_NDEF cleanup path that can leave stale pointers behind after a failure and cause a later BIO_pop() to dereference freed memory. In the supplied CISA/Hitachi Energy advisory, this upstream issue is mapped to Hitachi Energy PCU400 and PCULogger products, with the main operational effect described as a likely crash. The source indicates no confidentialit [truncated]
CVE-2022-4450, as published in the 2025-02-25 CISA advisory for Hitachi Energy PCU400, describes an OpenSSL PEM parsing flaw that can leave a freed header buffer reachable after a failed parse. If a caller frees that buffer again, a double free can occur, most likely crashing the process. In the supplied advisory, the impact is denial of service, and the issue is relevant to affected PCU400 and PCULogger [truncated]
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.
CVE-2020-35198 is a critical memory-corruption issue described as an integer overflow in Wind River VxWorks 7 calloc() size calculation. In the supplied CISA CSAF advisory, Hitachi Energy maps the issue to multiple Relion 670, Relion 650, and SAM-IO product versions and provides fixed-version updates for many affected releases. The advisory was initially published on 2021-12-16 and revised on 2025-05-27 t [truncated]
CVE-2021-35534 is an industrial-control vulnerability in Hitachi Energy Relion 670/650/SAM600-IO products. CISA and the vendor describe a database-schema weakness that can be abused after an attacker already has valid account credentials or a session ticket. Through the configuration tool using the proprietary ODBC protocol on TCP 2102, an attacker may manipulate database tables for privilege escalation, [truncated]
CVE-2013-5211 is a denial-of-service vulnerability affecting Hitachi Energy TropOS devices series 1400/2400/6400. The vulnerability resides in the monlist feature in ntp_request.c in ntpd in NTP before version 4.2.7p26. Remote attackers can exploit this flaw by sending forged REQ_MON_GETLIST or REQ_MON_GETLIST_1 requests to cause traffic amplification, resulting in denial of service conditions. This vulne [truncated]
