CVE-2024-2617 Security feature bypass in RTU500 series CMU firmware
Authenticated users can bypass secure update mechanisms to install unsigned firmware on RTU500 devices if the feature is not enabled on all CMUs.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2617?
CVE-2024-2617 is a high-severity vulnerability in Hitachi Energy RTU500 series CMU firmware, published on 30 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update,
if secure update feature was not enabled on all CMUs of a RTU500. If a malicious actor successfully exploits this vulnerability, they could use it to update the RTU500 with unsigned firmware.
Weakness: CWE-358
Which versions are affected by CVE-2024-2617?
How do I fix CVE-2024-2617?
No fix has been published for CVE-2024-2617 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2617 being exploited?
There is no known exploitation of CVE-2024-2617 in the wild and no public exploit code.
Sources
Also known as GHSA-8rv2-8c5x-g54v.