High severity · published May 2, 2022
CVE-2022-28613
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above
7.5
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rtu500 Firmware · Abb
12.2.1.0 before 12.2.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-28613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-28613
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000103&LanguageCode=en&DocumentPartId=&Action=Launch
search.abb.com
https://search.abb.com/library/Download.aspx?DocumentID=8DBD000103&LanguageCode=en&DocumentPartId=&Action=Launch