CVE-2022-2502 Denial of service in RTU500 series

High 7.5 Published 26 Jul 2023 Updated 5 Mar 2025

An attacker can cause a denial of service by sending a crafted message to the RTU500, triggering a buffer overflow and reboot.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-2502?

CVE-2022-2502 is a high-severity denial of service vulnerability in Hitachi Energy RTU500 series, published on 26 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-5 and the CMU contains the license feature ‘Advanced security’ which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation which eventually if exploited causes an internal buffer to overflow in the HCI IEC 60870-5-104 function.

Weakness: CWE-20

Which versions are affected by CVE-2022-2502?

It affects 1 product.

Products include Hitachienergy Rtu500 Firmware.

How do I fix CVE-2022-2502?

No fix has been published for CVE-2022-2502 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-2502 being exploited?

There is no known exploitation of CVE-2022-2502 in the wild and no public exploit code.

Sources

Also known as GHSA-45rh-q5fv-wf42.