TI-2022-01926 Aliases CVE-2022-2081 GHSA-v3xr-m742-g2v3

Out-of-bounds write in Hitachi Energy RTU500 series CMU firmware

MEDIUM 40CWE-787Published 2024-01-04 · Updated 2025-05-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00636 50th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hitachi Energy	RTU500 series CMU firmware	12.0.1.0 – 12.0.13.0; 12.2.1.0 – 12.2.11.0; 12.4.1.0 – 12.4.11.0; 12.6.1.0 – 12.6.7.0; 12.7.1.0 – 12.7.3.0; 13.2.1.0 – 13.2.4.0; 13.3.1.0	—	No fix listed	CNA

RTU500 series CMU firmware VendorHitachi Energy Affected 12.0.1.0 – 12.0.13.0; 12.2.1.0 – 12.2.11.0; 12.4.1.0 – 12.4.11.0; 12.6.1.0 – 12.6.7.0; 12.7.1.0 – 12.7.3.0; 13.2.1.0 – 13.2.4.0; 13.3.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:o:hitachienergy:rtu520_firmware::::::::	12.0.1 – 12.0.13; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.7; 12.7.1 – 12.7.3; 13.2.1 – 13.2.4	Vulnerable	Hitachi Energy
cpe:2.3:o:hitachienergy:rtu520_firmware:13.3.1:::::::*	13.3.1	Vulnerable	Hitachi Energy
cpe:2.3:h:hitachienergy:rtu520:-:::::::*	not specified by NVD	Running on	Hitachi Energy
cpe:2.3:o:hitachienergy:rtu530_firmware::::::::	12.0.1 – 12.0.13; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.7; 12.7.1 – 12.7.3; 13.2.1 – 13.2.4	Vulnerable	Hitachi Energy
cpe:2.3:o:hitachienergy:rtu530_firmware:13.3.1:::::::*	13.3.1	Vulnerable	Hitachi Energy
cpe:2.3:h:hitachienergy:rtu530:-:::::::*	not specified by NVD	Running on	Hitachi Energy
cpe:2.3:o:hitachienergy:rtu540_firmware::::::::	12.0.1 – 12.0.13; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.7; 12.7.1 – 12.7.3; 13.2.1 – 13.2.4	Vulnerable	Hitachi Energy
cpe:2.3:o:hitachienergy:rtu540_firmware:13.3.1:::::::*	13.3.1	Vulnerable	Hitachi Energy
cpe:2.3:h:hitachienergy:rtu540:-:::::::*	not specified by NVD	Running on	Hitachi Energy
cpe:2.3:o:hitachienergy:rtu560_firmware::::::::	12.0.1 – 12.0.13; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.7; 12.7.1 – 12.7.3; 13.2.1 – 13.2.4	Vulnerable	Hitachi Energy

cpe:2.3:o:hitachienergy:rtu520_firmware:*:*:*:*:*:*:*:* Versions 12.0.1 – 12.0.13; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.7; 12.7.1 – 12.7.3; 13.2.1 – 13.2.4 Vulnerable ·Hitachi Energy
cpe:2.3:o:hitachienergy:rtu520_firmware:13.3.1:*:*:*:*:*:*:* Versions 13.3.1 Vulnerable ·Hitachi Energy
cpe:2.3:h:hitachienergy:rtu520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
cpe:2.3:o:hitachienergy:rtu530_firmware:*:*:*:*:*:*:*:* Versions 12.0.1 – 12.0.13; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.7; 12.7.1 – 12.7.3; 13.2.1 – 13.2.4 Vulnerable ·Hitachi Energy
cpe:2.3:o:hitachienergy:rtu530_firmware:13.3.1:*:*:*:*:*:*:* Versions 13.3.1 Vulnerable ·Hitachi Energy
cpe:2.3:h:hitachienergy:rtu530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
cpe:2.3:o:hitachienergy:rtu540_firmware:*:*:*:*:*:*:*:* Versions 12.0.1 – 12.0.13; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.7; 12.7.1 – 12.7.3; 13.2.1 – 13.2.4 Vulnerable ·Hitachi Energy
cpe:2.3:o:hitachienergy:rtu540_firmware:13.3.1:*:*:*:*:*:*:* Versions 13.3.1 Vulnerable ·Hitachi Energy
cpe:2.3:h:hitachienergy:rtu540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
cpe:2.3:o:hitachienergy:rtu560_firmware:*:*:*:*:*:*:*:* Versions 12.0.1 – 12.0.13; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.7; 12.7.1 – 12.7.3; 13.2.1 – 13.2.4 Vulnerable ·Hitachi Energy

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:hitachienergy:rtu560_firmware:13.3.1:::::::*	13.3.1	Vulnerable	Hitachi Energy
cpe:2.3:h:hitachienergy:rtu560:-:::::::*	not specified by NVD	Running on	Hitachi Energy

cpe:2.3:o:hitachienergy:rtu560_firmware:13.3.1:*:*:*:*:*:*:* Versions 13.3.1 Vulnerable ·Hitachi Energy
cpe:2.3:h:hitachienergy:rtu560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-2081
2026-10-03 Alias added: GHSA-v3xr-m742-g2v3
2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://publisher.hitachienergy.com/preview?DocumentID=8DBD000111&LanguageCode=en&DocumentPartId=&Action=Launch

TI-2026-01456 IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of… CVSS 4.0HIGH 8.7
TI-2023-05307 Cross-site scripting in Hitachi Energy RTU500 CVSS 3.1MEDIUM 6.1
TI-2023-05306 Cross-site scripting in Hitachi Energy RTU500 series CVSS 3.1MEDIUM 6.1
TI-2023-05305 Cross-site scripting in Hitachi Energy RTU500 CVSS 3.1MEDIUM 6.1
TI-2026-01455 RTU500 web interface: An unprivileged user can read user management information. CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences