CVE-2022-3353: IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products

High severity · published Feb 21, 2023

CVE-2022-3353

IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products

7.5

CVSS

1.1%

EPSS

On KEV

Description

A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An attacker could exploit the vulnerability by using a specially crafted message sequence, to force the IEC 61850 MMS-server communication stack, to stop accepting new MMS-client connections. Already existing/established client-server connections are not affected. List of affected CPEs: * cpe:2.3:o:hitachienergy:fox61x_tego1:r15b08:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16_3:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1e01:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1d02:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1c07:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1b02:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:gms600:1.3.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.1.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.5.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.2:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.8.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.0.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.4:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.5:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:mms:2.2.3:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.2:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:reb500:7:*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:reb500:8:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:1.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.0.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:1.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:1.3.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:2.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.1:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.5:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:2.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:rtu500cmu:12.*.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:rtu500cmu:13.*.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:2.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:3.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_5:3.0:*:*:*:*:*:*:*

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.1% · higher than 66% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FOX61x TEGO1 · Hitachi Energy

tego1_r15b08; tego1_r2a16_03; tego1_r2a16; tego1_r1e01; tego1_r1d02; tego1_r1c07; +1 more · source: vendor

GMS600 · Hitachi Energy

GMS600 1.3 · source: vendor

ITT600 SA Explorer · Hitachi Energy

ITT600 SA Explorer 1.1.0; ITT600 SA Explorer 1.1.1; ITT600 SA Explorer 1.1.2; ITT600 SA Explorer 1.5.0; ITT600 SA Explorer 1.5.1; ITT600 SA Explorer 1.6.0; +12 more · source: vendor, NVD

MSM · Hitachi Energy

MSM 2.2.3;0 · source: vendor

MicroSCADA X SYS600 · Hitachi Energy

SYS600 10; SYS600 10.1; SYS600 10.1.1; SYS600 10.2; SYS600 10.2.1; SYS600 10.3; +2 more · source: vendor

PWC600 · Hitachi Energy

PWC600 1.0; PWC600 1.1; PWC600 1.2 · source: vendor

REB500 · Hitachi Energy

REB500 7.0 before 7.*; REB500 8.0 before 8.* · source: vendor

RTU500 · Hitachi Energy

RTU500 12.0.1 through 12.0.14; RTU500 12.2.1 through 12.2.11; RTU500 12.4.1 through 12.4.11; RTU500 12.6.1 through 12.6.8; RTU500 12.7.1 through 12.7.4; RTU500 13.2.1 through 13.2.5; +2 more · source: vendor

Relion® 650 · Hitachi Energy

Relion 650 1.1; Relion 650 1.3; Relion 650 2.1; Relion 650 2.2.0; Relion 650 2.2.1; Relion 650 2.2.2; +3 more · source: vendor

Relion® 670 · Hitachi Energy

Relion 670 1.2; Relion 670 2.0; Relion 670 version 2.1; Relion 670 2.2.0; Relion 670 2.2.1; Relion 670 2.2.2; +3 more · source: vendor

SAM600-IO · Hitachi Energy

Relion SAM600-IO 2.2.1; Relion SAM600-IO 2.2.5 · source: vendor

TXpert Hub CoreTec 4 · Hitachi Energy

CoreTec 4 version 2.0.*; CoreTec 4 version 2.1.*; CoreTec 4 version 2.2.*; CoreTec 4 version 2.3.*; CoreTec 4 version 2.4.*; CoreTec 4 version 3.0.* · source: vendor

Affected product

FOX61x TEGO1

Hitachi Energy

All FOX61x TEGO1 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-3353

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-3353

Vendor Advisory

https://search.abb.com/library/Download.aspx?DocumentID=8DBD000124&LanguageCode=en&DocumentPartId=&Action=Launch

Vendor Advisory