Lucene search

[email protected]CVE-2023-4518

HistoryDec 01, 2023 - 3:15 p.m.

CVE-2023-4518

2023-12-0115:15:07

CWE-1284

CWE-20

[email protected]

web.nvd.nist.gov

vulnerability

input validation

goose messages

device reboot

cve-2023-4518

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

A vulnerability exists in the input validation of the GOOSE
messages where out of range values received and processed
by the IED caused a reboot of the device. In order for an
attacker to exploit the vulnerability, goose receiving blocks need
to be configured.

Affected configurations

NVD

Node

hitachienergyrelion_670_firmwareRange2.2.0–2.2.2.6

hitachienergyrelion_670_firmwareRange2.2.3–2.2.3.7

hitachienergyrelion_670_firmwareRange2.2.4–2.2.4.4

hitachienergyrelion_670_firmwareRange2.2.5–2.2.5.6

AND

hitachienergyrelion_670Match-

Node

hitachienergyrelion_650_firmwareRange2.2.4–2.2.4.4

hitachienergyrelion_650_firmwareRange2.2.5–2.2.5.6

hitachienergyrelion_650_firmwareMatch2.2.1

hitachienergyrelion_650_firmwareMatch2.2.1.6

AND

hitachienergyrelion_650Match-

Node

hitachienergyrelion_sam600-io_firmwareRange2.2.5–2.2.5.6

hitachienergyrelion_sam600-io_firmwareMatch2.2.1

hitachienergyrelion_sam600-io_firmwareMatch2.2.1.6

AND

hitachienergyrelion_sam600-ioMatch-

CPENameOperatorVersion
hitachienergy:relion_670_firmwarehitachienergy relion 670 firmwarelt2.2.2.6
hitachienergy:relion_670_firmwarehitachienergy relion 670 firmwarelt2.2.3.7
hitachienergy:relion_670_firmwarehitachienergy relion 670 firmwarelt2.2.4.4
hitachienergy:relion_670_firmwarehitachienergy relion 670 firmwarelt2.2.5.6

CPE	Name	Operator	Version
hitachienergy:relion_670_firmware	hitachienergy relion 670 firmware	lt	2.2.2.6
hitachienergy:relion_670_firmware	hitachienergy relion 670 firmware	lt	2.2.3.7
hitachienergy:relion_670_firmware	hitachienergy relion 670 firmware	lt	2.2.4.4
hitachienergy:relion_670_firmware	hitachienergy relion 670 firmware	lt	2.2.5.6

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Relion670",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "status": "affected",
        "version": " Relion 670 series version 2.2.0 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670/650/SAM600-IO series version 2.2.1 all revisions"
      },
      {
        "status": "affected",
        "version": "elion 670 series version 2.2.2 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670 series version 2.2.3 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670/650 series version 2.2.4 all revisions"
      },
      {
        "status": "affected",
        "version": "Relion 670/650/SAM600-IO series version 2.2.5 all revisions"
      }
    ]
  }
]

References

publisher.hitachienergy.com/preview?DocumentId=8DBD000170&languageCode=en&Preview=true

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Related for CVE-2023-4518

prion1 nvd1 cvelist1 nessus1