CVE-2023-5768 Denial of service in RTU500 series

Medium 5.9 Published 4 Dec 2023 Updated 2 Aug 2024

An attacker can cause a denial of service on the communication link of Hitachi Energy RTU500 series devices by sending malformed APDU frames.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-5768?

CVE-2023-5768 is a medium-severity denial of service vulnerability in Hitachi Energy RTU500 series, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong received APDU frame layout may cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer with wrong length information of APDU or delayed reception of data octets.

Only communication link of affected HCI IEC 60870-5-104 is blocked. If attack sequence stops the communication to the previously attacked link gets normal again.

Weakness: CWE-79

Which versions are affected by CVE-2023-5768?

It affects 4 products.

Products include Hitachienergy Rtu520 Firmware, Hitachienergy Rtu530 Firmware, Hitachienergy Rtu540 Firmware, Hitachienergy Rtu560 Firmware.

How do I fix CVE-2023-5768?

No fix has been published for CVE-2023-5768 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-5768 being exploited?

There is no known exploitation of CVE-2023-5768 in the wild and no public exploit code.

Sources

Also known as GHSA-gv34-7cg2-7vfg.