High severity · published Jan 4, 2024
CVE-2022-2081
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rtu520 Firmware · Hitachienergy
12.0.1 through 12.0.13; 12.2.1 through 12.2.11; 12.4.1 through 12.4.11; 12.6.1 through 12.6.7; 12.7.1 through 12.7.3; 13.2.1 through 13.2.4; +1 more · source: NVD
RF
Rtu530 Firmware · Hitachienergy
12.0.1 through 12.0.13; 12.2.1 through 12.2.11; 12.4.1 through 12.4.11; 12.6.1 through 12.6.7; 12.7.1 through 12.7.3; 13.2.1 through 13.2.4; +1 more · source: NVD
RF
Rtu540 Firmware · Hitachienergy
12.0.1 through 12.0.13; 12.2.1 through 12.2.11; 12.4.1 through 12.4.11; 12.6.1 through 12.6.7; 12.7.1 through 12.7.3; 13.2.1 through 13.2.4; +1 more · source: NVD
RF
Rtu560 Firmware · Hitachienergy
12.0.1 through 12.0.13; 12.2.1 through 12.2.11; 12.4.1 through 12.4.11; 12.6.1 through 12.6.7; 12.7.1 through 12.7.3; 13.2.1 through 13.2.4; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2081
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2081
Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000111&LanguageCode=en&DocumentPartId=&Action=Launch
More from Rtu520 Firmware
7.5
CVE-2026-1773
IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality…
6.1
CVE-2023-5769
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below
6.1
CVE-2023-5768
A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below
6.1
CVE-2023-5767
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below
5.3
CVE-2026-1772
RTU500 web interface: An unprivileged user can read user management information