CVE-2022-29492

A vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected conne ...

Description

Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected connection is left open. This issue affects: Hitachi Energy MicroSCADA Pro SYS600 version 9.4 FP2 Hotfix 4 and earlier versions Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*

Remediation

Solution:

  • Remediated in SYS600 10.4 For MicroSCADA Pro SYS600 - Upgrade to at least SYS600 version 10.4. For MicroSCADA X SYS600 - Update to at least SYS600 version 10.4.

Workaround:

  • Apply general mitigation factors as specify in the advisory.

Category

5.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.07%
Vendor Advisory abb.com
Affected: Hitachi Energy MicroSCADA X SYS600
Affected: Hitachi Energy MicroSCADA Pro SYS600
Published at:
Updated at:

References

Link Tags
https://search.abb.com/library/Download.aspx?DocumentID=8DBD000106&LanguageCode=en&DocumentPartId=&Action=Launch vendor advisory

Frequently Asked Questions

What is the severity of CVE-2022-29492?
CVE-2022-29492 has been scored as a medium severity vulnerability.
How to fix CVE-2022-29492?
To fix CVE-2022-29492: Remediated in SYS600 10.4 For MicroSCADA Pro SYS600 - Upgrade to at least SYS600 version 10.4. For MicroSCADA X SYS600 - Update to at least SYS600 version 10.4.
Is CVE-2022-29492 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-29492 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-29492?
CVE-2022-29492 affects Hitachi Energy MicroSCADA X SYS600, Hitachi Energy MicroSCADA Pro SYS600.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.