✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Software Developers Tricked into Installing Malware by False npm Packages – Active IOCs

April 29, 2024
Rewterz

Cyberattack Aims at Ukraine Using a Seven-Year-Old Microsoft Office Vulnerability – Active IOCs

April 29, 2024

ICS: Multiple Hitachi Energy RTU500 Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2023-1514 CVSS:7.4

Hitachi Energy RTU500 Scripting Interface could allow a remote attacker to conduct spoofing attacks, caused by improper verification of certification. By using faking the identity of a RTU500 device, an attacker could exploit this vulnerability to spoof the identity of the service.

CVE-2023-5767 CVSS:6

Hitachi Energy RTU500 series devices are vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the webserver. A remote authenticated attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2023-5769 CVSS:5.9

Hitachi Energy RTU500 series devices are vulnerable to a denial of service, caused by an error in the HCI IEC 60870-5-104 function. By reading incoming frames on link layer with wrong length information of APDU or delayed reception of data octets, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2023-5768 CVSS:5.4

Hitachi Energy RTU500 series devices are vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the webserver. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Impact

  • Denial of Service
  • Gain Access
  • Cross-Site Scripting

Indicators of Compromise

CVE

  • CVE-2023-1514
  • CVE-2023-5767
  • CVE-2023-5769
  • CVE-2023-5768

Affected Vendors

Hitachi

Affected Products

  • Hitachi Energy RTU500 series CMU Firmware 12.0.1
  • Hitachi Energy RTU500 series CMU Firmware 12.2.1
  • Hitachi Energy RTU500 series CMU Firmware 12.4.1
  • Hitachi Energy RTU500 series CMU Firmware 12.6.1
  • Hitachi Energy RTU500 series CMU Firmware 12.7.1
  • Hitachi Energy RTU500 series CMU Firmware 13.2.1
  • Hitachi Energy RTU500 series CMU Firmware 13.4.1
  • Hitachi Energy RTU500 series CMU Firmware 12.0.14
  • Hitachi Energy RTU500 series CMU Firmware 12.2.11
  • Hitachi Energy RTU500 series CMU Firmware 12.4.11
  • Hitachi Energy RTU500 series CMU Firmware 12.6.9
  • Hitachi Energy RTU500 series CMU Firmware 12.7.6
  • Hitachi Energy RTU500 series CMU Firmware 13.2.6
  • Hitachi Energy RTU500 series CMU Firmware 13.4.3
  • Hitachi Energy RTU500 Scripting Interface 1.0.1.30
  • Hitachi Energy RTU500 Scripting Interface 1.0.2
  • Hitachi Energy RTU500 Scripting Interface 1.1.1

Remediation

Refer to Hitachi Energy for patch, upgrade or suggested workaround information.

Hitachi Energy RTU500 Scripting Interface

Hitachi Energy RTU500 series CMU Firmware

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo