Hitachi Energy RTU500 up to 13.7.0 Web Server null pointer dereference

Summaryinfo

A vulnerability classified as problematic has been found in Hitachi Energy RTU500 up to 13.7.0. This affects an unknown part of the component Web Server. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2024-10037. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Hitachi Energy RTU500 up to 13.7.0. It has been declared as problematic. Affected by this vulnerability is some unknown processing of the component Web Server. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. The summary by CVE is:

A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection. An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability. The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.

The advisory is shared at publisher.hitachienergy.com. This vulnerability is known as CVE-2024-10037 since 10/16/2024. The exploitation appears to be difficult. The attack can be launched remotely. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 12.7.8 or 13.7.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Hitachi Energy

Name

• RTU500

Version

• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.0.4
• 12.0.5
• 12.0.6
• 12.0.7
• 12.0.8
• 12.0.9
• 12.0.10
• 12.0.11
• 12.0.12
• 12.0.13
• 12.0.14
• 12.2.0
• 12.2.1
• 12.2.2
• 12.2.3
• 12.2.4
• 12.2.5
• 12.2.6
• 12.2.7
• 12.2.8
• 12.2.9
• 12.2.10
• 12.2.11
• 12.2.12
• 12.4.0
• 12.4.1
• 12.4.2
• 12.4.3
• 12.4.4
• 12.4.5
• 12.4.6
• 12.4.7
• 12.4.8
• 12.4.9
• 12.4.10
• 12.4.11
• 12.6.0
• 12.6.1
• 12.6.2
• 12.6.3
• 12.6.4
• 12.6.5
• 12.6.6
• 12.6.7
• 12.6.8
• 12.6.9
• 12.6.10
• 12.7.0
• 12.7.1
• 12.7.2
• 12.7.3
• 12.7.4
• 12.7.5
• 12.7.6
• 12.7.7
• 13.0
• 13.1
• 13.2
• 13.2.0
• 13.2.1
• 13.2.2
• 13.2.3
• 13.2.4
• 13.2.5
• 13.2.6
• 13.2.7
• 13.3
• 13.4
• 13.4.0
• 13.4.1
• 13.4.2
• 13.4.3
• 13.4.4
• 13.5
• 13.5.0
• 13.5.1
• 13.5.2
• 13.5.3
• 13.6
• 13.6.0
• 13.6.1
• 13.7.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion