Medium severity · published Mar 25, 2025
CVE-2024-10037
A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a…
4.4
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection.
An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability.
The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
RTU500 · Hitachi Energy
12.0.1 through 12.0.14; 12.2.1 through 12.2.12; 12.4.1 through 12.4.11; 12.6.1 through 12.6.10; 12.7.1 through 12.7.7; 13.2.1 through 13.2.7; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10037
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
More from RTU500
7.5
CVE-2025-1445
A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in…
7.5
CVE-2022-3353
IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products
6.5
CVE-2024-12169
A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to…
6.1
CVE-2023-5769
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below
6.1
CVE-2023-5767
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below