Medium severity · published Mar 25, 2025
CVE-2024-11499
A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a CMU restart
4.9
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a CMU restart. The vulnerability can be triggered if certificates are updated while in use on active connections.
The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
RTU500 · Hitachi Energy
13.4.1 through 13.4.4; 13.5.1 through 13.5.3; 13.5.3; 13.6.1; 13.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11499
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
More from RTU500
7.5
CVE-2025-1445
A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in…
7.5
CVE-2022-3353
IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products
6.5
CVE-2024-12169
A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to…
6.1
CVE-2023-5769
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below
6.1
CVE-2023-5767
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below