CVE-2024-10037
Medium
Description
A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection. An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability. The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.
SeverityMedium
CVSS4.4
Exploit probability—
ProductRTU500
PublishedMar 25, 2025
First seenMar 25, 2025
Weakness typeCWE-476NULL pointer dereference
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Hitachi Energy RTU500 | 12.0.1 ≤ v ≤ 12.0.14, 12.2.1 ≤ v ≤ 12.2.12, 12.4.1 ≤ v ≤ 12.4.11, 12.6.1 ≤ v ≤ 12.6.10, 12.7.1 ≤ v ≤ 12.7.7, 13.2.1 ≤ v ≤ 13.2.7, 13.4.1 ≤ v ≤ 13.4.4, 13.5.1 ≤ v ≤ 13.5.3, 13.6.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.