CVE-2025-1445 Denial of service in RTU500
Attackers can cause denial of service in Hitachi RTU500 devices by exploiting timing issues during TLS renegotiation in IEC61850 communications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-1445?
CVE-2025-1445 is a high-severity denial of service vulnerability in Hitachi Energy RTU500, published on 25 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations, when IEC61850 communication is active.
Precondition is that IEC61850 as client or server are configured using TLS on RTU500 device. It affects the CMU the IEC61850 stack is configured on.
Weakness: CWE-820
Which versions are affected by CVE-2025-1445?
How do I fix CVE-2025-1445?
No fix has been published for CVE-2025-1445 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-1445 being exploited?
There is no known exploitation of CVE-2025-1445 in the wild and no public exploit code.
Sources
Also known as GHSA-hcgq-vpp8-j6q4.