Lucene search

[email protected]CVE-2022-3864

HistoryJan 04, 2024 - 10:15 a.m.

CVE-2022-3864

2024-01-0410:15:11

CWE-347

[email protected]

web.nvd.nist.gov

cve-2022-3864

relion

update package

signature validation

ied

restart

denial of service

nvd

4.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

4.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.5%

JSON

A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device is back to normal operation.
An attacker could exploit the vulnerability by first gaining access to
the system with security privileges and attempt to update the IED
with a malicious update package. Successful exploitation of this
vulnerability will cause the IED to restart, causing a temporary Denial of Service.

Affected configurations

NVD

Node

hitachienergyrelion_650Match-

AND

hitachienergyrelion_650_firmwareMatch2.2.0

hitachienergyrelion_650_firmwareMatch2.2.1

hitachienergyrelion_650_firmwareMatch2.2.4

hitachienergyrelion_650_firmwareMatch2.2.5

Node

hitachienergyrelion_670Match-

AND

hitachienergyrelion_670_firmwareMatch2.2.0

hitachienergyrelion_670_firmwareMatch2.2.1

hitachienergyrelion_670_firmwareMatch2.2.2

hitachienergyrelion_670_firmwareMatch2.2.3

hitachienergyrelion_670_firmwareMatch2.2.4

hitachienergyrelion_670_firmwareMatch2.2.5

Node

hitachienergyrelion_sam600-ioMatch-

AND

hitachienergyrelion_sam600-io_firmwareMatch2.2.1

CPENameOperatorVersion
hitachienergy:relion_650_firmwarehitachienergy relion 650 firmwareeq2.2.0
hitachienergy:relion_650_firmwarehitachienergy relion 650 firmwareeq2.2.1
hitachienergy:relion_650_firmwarehitachienergy relion 650 firmwareeq2.2.4
hitachienergy:relion_650_firmwarehitachienergy relion 650 firmwareeq2.2.5

CPE	Name	Operator	Version
hitachienergy:relion_650_firmware	hitachienergy relion 650 firmware	eq	2.2.0
hitachienergy:relion_650_firmware	hitachienergy relion 650 firmware	eq	2.2.1
hitachienergy:relion_650_firmware	hitachienergy relion 650 firmware	eq	2.2.4
hitachienergy:relion_650_firmware	hitachienergy relion 650 firmware	eq	2.2.5

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Relion 670/650/SAM600-IO Series",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "status": "affected",
        "version": "Relion 670/650 series version 2.2.0 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670/650/SAM600-IO series version 2.2.1 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670 series version 2.2.2 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670 series version 2.2.3 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670/650 series version 2.2.4 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670/650 series version 2.2.5 all revisions"
      }
    ]
  }
]