CVE-2022-3864 Security feature bypass in Relion 670/650/SAM600-IO Series
An attacker with privileged access can bypass signature validation to install a tampered update, causing a temporary denial of service on Hitachi Energy Relion IEDs.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3864?
CVE-2022-3864 is a medium-severity vulnerability in Hitachi Energy Relion 670/650/SAM600-IO Series, published on 4 Jan 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device is back to normal operation. An attacker could exploit the vulnerability by first gaining access to the system with security privileges and attempt to update the IED with a malicious update package. Successful exploitation of this vulnerability will cause the IED to restart, causing a temporary Denial of Service.
Weakness: CWE-347
Which versions are affected by CVE-2022-3864?
It affects 3 products.
Products include Hitachienergy Relion 650 Firmware, Hitachienergy Relion 670 Firmware, Hitachienergy Relion Sam600-Io Firmware.
How do I fix CVE-2022-3864?
No fix has been published for CVE-2022-3864 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3864 being exploited?
There is no known exploitation of CVE-2022-3864 in the wild and no public exploit code.
Other vulnerabilities in Hitachi Energy Relion 670/650/SAM600-IO Series
Sources
Also known as GHSA-5pj9-g7qw-3qwv.