CVE-2023-4518

A vulnerability exists in the input validation of the GOOSE 
messages where out of range values received and processed 
by the IED caused a reboot of the device. In order for an 
attacker to exploit the vulnerability, goose receiving blocks need 
to be configured.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Hitachi EnergyCNA
6.5 MEDIUM
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 30%
VendorProductVersion
hitachienergyrelion_670_firmware
2.2.0 ≤
𝑥
< 2.2.2.6
hitachienergyrelion_670_firmware
2.2.3 ≤
𝑥
< 2.2.3.7
hitachienergyrelion_670_firmware
2.2.4 ≤
𝑥
< 2.2.4.4
hitachienergyrelion_670_firmware
2.2.5 ≤
𝑥
< 2.2.5.6
hitachienergyrelion_650_firmware
2.2.4 ≤
𝑥
< 2.2.4.4
hitachienergyrelion_650_firmware
2.2.5 ≤
𝑥
< 2.2.5.6
hitachienergyrelion_650_firmware
2.2.1
hitachienergyrelion_650_firmware
2.2.1.6
hitachienergyrelion_sam600-io_firmware
2.2.5 ≤
𝑥
< 2.2.5.6
hitachienergyrelion_sam600-io_firmware
2.2.1
hitachienergyrelion_sam600-io_firmware
2.2.1.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000170&languageCode=en&Preview=true
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000170&languageCode=en&Preview=true