CVEvulnerability

CVE-2022-28613

7.5 HIGH Published 2022-05-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-05-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-1284

Description

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.

Affected configurations

• abb rtu500 firmware (>= 12.2.1.0 < 12.2.12.0) • hitachienergy rtu500 firmware (>= 12.0.1.0 < 12.0.14.0) • hitachienergy rtu500 firmware (>= 12.4.1.0 < 12.4.12.0) • hitachienergy rtu500 firmware (>= 12.6.1.0 < 12.6.8.0) • hitachienergy rtu500 firmware (>= 12.7.1.0 < 12.7.4.0) • hitachienergy rtu500 firmware (>= 13.2.1.0 < 13.2.5.0)

Related

Weakness · CWE (1)

  • CWE-1284 Improper Validation of Specified Quantity in Input weakness

References