All CISA Advisories, EN

Hitachi Energy RTU500

View CSAF

Summary

Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. If exploited, these vulnerabilities primarily impact product availability, with potential secondary impacts on confidentiality and integrity. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

The following versions of Hitachi Energy RTU500 are affected:

  • RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/>=12.7.1|<=12.7.7, vers:RTU500_series_CMU_Firmware/>=13.5.1|<=13.5.4, vers:RTU500_series_CMU_Firmware/>=13.6.1|<=13.6.3, vers:RTU500_series_CMU_Firmware/>=13.7.1|<=13.7.8, 13.8.1, vers:RTU500_series_CMU_Firmware/>=13.7.1|<=13.7.7 (CVE-2025-69421, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-8479, CVE-2025-69421, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-8479, CVE-2025-69421, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-8479, CVE-2025-69421, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2025-69421, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-8479, CVE-2026-8479)
CVSS Vendor Equipment Vulnerabilities
v3 7.8 Hitachi Energy Hitachi Energy RTU500 NULL Pointer Dereference, Integer Overflow or Wraparound, Loop with Unreachable Exit Condition (‘Infinite Loop’)

Background

  • Critical Infrastructure Sectors: Dams, Energy, Water and Wastewater
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Switzerland

Vulnerabilities

Expand All +

CVE-2025-69421

CWE-476: NULL Pointer Dereference. Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing Denial of Service impact. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Product is affected, if a privileged user uploads a malformed PKCS#12 certificate via web interface or if PKI client functionality is configured.

View CVE Details

Affected Products

Hitachi Energy RTU500
Vendor:
Hitachi Energy
Product Version:
RTU500 series CMU Firmware version 12.7.1 – 12.7.7, RTU500 series CMU Firmware version 13.5.1 – 13.5.4, RTU500 series CMU Firmware version 13.6.1 – 13.6.3, RTU500 series CMU Firmware version 13.7.1 – 13.7.8, RTU500 series CMU Firmware version 13.8.1
Product Status:
known_affected
Remediations

Vendor fix
Update to CMU Firmware version 13.8.2

Mitigation
Follow general mitigation factors/workarounds

Vendor fix
Update to CMU Firmware version 13.7.9 (when available) or 13.8.2

Relevant CWE: CWE-476 NULL Pointer Dereference

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

This article has been indexed from All CISA Advisories

Read the original article: