CVE-2022-28613

Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series

Description

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.

Remediation

Solution:

  • Remediation available, see the advisory for details.

Category

7.5
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.13%
Vendor Advisory hitachienergy.com
Affected: Hitachi Energy RTU500 series CMU Firmware
Published at:
Updated at:

References

Link Tags
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000103&LanguageCode=en&DocumentPartId=&Action=Launch vendor advisory
https://search.abb.com/library/Download.aspx?DocumentID=8DBD000103&LanguageCode=en&DocumentPartId=&Action=Launch

Frequently Asked Questions

What is the severity of CVE-2022-28613?
CVE-2022-28613 has been scored as a high severity vulnerability.
How to fix CVE-2022-28613?
To fix CVE-2022-28613: Remediation available, see the advisory for details.
Is CVE-2022-28613 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-28613 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-28613?
CVE-2022-28613 affects Hitachi Energy RTU500 series CMU Firmware.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.