Threat Investigation
Request a demo

CVE-2023-4518

Medium

Description

A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.

SeverityMedium
CVSS6.5
Exploit probability—
ProductHitachienergy Relion 670 Firmware
PublishedDec 1, 2023
First seenDec 1, 2023
Weakness typeCWE-1284CWE-1284

How to fix

Update
  • hitachienergy relion_670_firmware2.2.2.6, 2.2.3.7, 2.2.4.4, 2.2.5.6 or later
  • hitachienergy relion_650_firmware2.2.4.4, 2.2.5.6 or later
  • hitachienergy relion_sam600-io_firmware2.2.5.6 or later

Affected products

ProductAffected versionsFixed in
hitachienergy relion_670_firmware2.2.0 ≤ v < 2.2.2.6, 2.2.3 ≤ v < 2.2.3.7, 2.2.4 ≤ v < 2.2.4.4, 2.2.5 ≤ v < 2.2.5.62.2.2.6, 2.2.3.7, 2.2.4.4, 2.2.5.6
hitachienergy relion_650_firmware2.2.4 ≤ v < 2.2.4.4, 2.2.5 ≤ v < 2.2.5.6, 2.2.1, 2.2.1.62.2.4.4, 2.2.5.6
hitachienergy relion_sam600-io_firmware2.2.5 ≤ v < 2.2.5.6, 2.2.1, 2.2.1.62.2.5.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.