Buffer overflow in Hitachi Energy RTU500 series CMU Firmware
Priority LOW 34CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.
Why it matters now
EPSS 0.00669 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi Energy | RTU500 series CMU Firmware | 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3; 13.5.1 | — | No fix listed | CNA |
- RTU500 series CMU Firmware VendorHitachi Energy Affected 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3; 13.5.1 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachienergy:rtu500_firmware:*:*:*:*:*:*:*:* | 12.0.1.0 to before 12.0.15.0; 12.2.1.0 to before 12.2.12.0; 12.4.1.0 to before 12.4.12.0; 12.6.1.0 to before 12.6.10.0; 12.7.1.0 to before 12.7.7.0; 13.2.1.0 to before 13.2.7.0; 13.4.1.0 to before 13.4.4.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:rtu500_firmware:13.5.1.0:*:*:*:*:*:*:* | 13.5.1.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:rtu500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
- cpe:2.3:o:hitachienergy:rtu500_firmware:*:*:*:*:*:*:*:* Versions 12.0.1.0 to before 12.0.15.0; 12.2.1.0 to before 12.2.12.0; 12.4.1.0 to before 12.4.12.0; 12.6.1.0 to before 12.6.10.0; 12.7.1.0 to before 12.7.7.0; 13.2.1.0 to before 13.2.7.0; 13.4.1.0 to before 13.4.4.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:rtu500_firmware:13.5.1.0:*:*:*:*:*:*:* Versions 13.5.1.0 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:rtu500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6711
- 2026-10-03 Alias added: GHSA-x25m-g22v-6hgf
References
More Hitachi Energy Rtu500 Firmware vulnerabilities
- TI-2022-03099 IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products CVSS 3.1HIGH 7.5
- TI-2022-04211 Out-of-bounds write in Hitachi Energy RTU500 series CVSS 3.1HIGH 7.5
- TI-2022-02312 Improper input validation in Hitachi Energy RTU500 series CVSS 3.1HIGH 7.5
- TI-2021-08743 Specially Crafted IEC 61850 Protocol Sequence Vulnerability CVSS 3.1HIGH 7.5
- TI-2022-11258 Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series CVSS 3.1HIGH 7.5
- TI-2021-14264 Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series CVSS 3.1HIGH 7.5
Sources
- CVE-2023-6711 · CVE Program
- CVE-2023-6711 · NVD
- FIRST EPSS
- GHSA-x25m-g22v-6hgf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences