Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series
Priority LOW 35CWE-1284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.
Why it matters now
EPSS 0.0099 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi Energy | RTU500 series CMU Firmware | all versions; all versions; all versions; all versions; all versions; all versions | — | No fix listed | CNA |
- RTU500 series CMU Firmware VendorHitachi Energy Affected all versions; all versions; all versions; all versions; all versions; all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:abb:rtu500_firmware:*:*:*:*:*:*:*:* | 12.2.1.0 to before 12.2.12.0 | Vulnerable | ABB |
| cpe:2.3:o:hitachienergy:rtu500_firmware:*:*:*:*:*:*:*:* | 12.0.1.0 to before 12.0.14.0; 12.4.1.0 to before 12.4.12.0; 12.6.1.0 to before 12.6.8.0; 12.7.1.0 to before 12.7.4.0; 13.2.1.0 to before 13.2.5.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:rtu500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
- cpe:2.3:o:abb:rtu500_firmware:*:*:*:*:*:*:*:* Versions 12.2.1.0 to before 12.2.12.0 Vulnerable ·ABB
- cpe:2.3:o:hitachienergy:rtu500_firmware:*:*:*:*:*:*:*:* Versions 12.0.1.0 to before 12.0.14.0; 12.4.1.0 to before 12.4.12.0; 12.6.1.0 to before 12.6.8.0; 12.7.1.0 to before 12.7.4.0; 13.2.1.0 to before 13.2.5.0 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:rtu500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-28613
- 2026-10-03 Alias added: GHSA-9m5v-m5wp-xcm2
References
More Hitachi Energy Rtu500 Firmware vulnerabilities
- TI-2022-03099 IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products CVSS 3.1HIGH 7.5
- TI-2022-04211 Out-of-bounds write in Hitachi Energy RTU500 series CVSS 3.1HIGH 7.5
- TI-2022-02312 Improper input validation in Hitachi Energy RTU500 series CVSS 3.1HIGH 7.5
- TI-2021-08743 Specially Crafted IEC 61850 Protocol Sequence Vulnerability CVSS 3.1HIGH 7.5
- TI-2021-14264 Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series CVSS 3.1HIGH 7.5
- TI-2023-06138 Buffer overflow in Hitachi Energy RTU500 series CMU Firmware CVSS 3.1HIGH 7.5
Sources
- CVE-2022-28613 · CVE Program
- CVE-2022-28613 · NVD
- FIRST EPSS
- GHSA-9m5v-m5wp-xcm2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences