Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-28613

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.

Published

2022-05-02T19:15:09.200

Last Modified

2024-11-21T06:57:34.920

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

6.9

Weaknesses
  • Type: Secondary
    CWE-1284
  • Type: Primary
    CWE-1284
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System abb rtu500_firmware < 12.2.12.0 Yes
Operating System hitachienergy rtu500_firmware < 12.0.14.0 Yes
Operating System hitachienergy rtu500_firmware < 12.4.12.0 Yes
Operating System hitachienergy rtu500_firmware < 12.6.8.0 Yes
Operating System hitachienergy rtu500_firmware < 12.7.4.0 Yes
Operating System hitachienergy rtu500_firmware < 13.2.5.0 Yes
Hardware hitachienergy rtu500 - No
References