LiveActive security incident?Get immediate response
CVE Record

CVE-2022-2502: A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 serie...

A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-5 and the CMU contains the license feature ‘Advanced security’ which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation which eventually if exploited causes an internal buffer to overflow in the HCI IEC 60870-5-104 function.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2022-2502 can make certain Hitachi Energy RTU500 control units reboot, disrupting availability. It matters most in operational technology environments where RTU availability supports remote monitoring or control. Exposure is conditional: the affected firmware, IEC 60870-5-104 function, IEC 62351-5 support, and separately ordered Advanced security license must all be present.

Executive priority

Treat as high priority for exposed OT assets because the business impact is availability disruption. Scope first, because many RTU500 deployments may be unaffected unless the exact firmware, protocol security setting, and license preconditions are present.

Technical view

The flaw is missing input validation in the RTU500 HCI IEC 60870-5-104 function, leading to an internal buffer overflow and CMU reboot. CVSS 3.1 is 7.5: network reachable, low complexity, no privileges or user interaction, with high availability impact and no stated confidentiality or integrity impact.

Likely exposure

Likely limited to Hitachi Energy RTU500 series CMUs on firmware 13.3.1, 13.3.2, 13.3.3, or 13.4.1 with the specific protocol security configuration and license enabled.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation evidence. Exploitation is described as a specially crafted network message causing reboot, but no exploit details or public weaponization evidence are provided.

Researcher notes

The provided data names affected firmware and required configuration/license gates but does not include patch version details. CWE-20 is appropriate for missing validation. Analysis should avoid assuming broader RTU500 exposure beyond the stated HCI IEC 60870-5-104 and IEC 62351-5 conditions.

Mitigation direction

  • Review Hitachi Energy advisory for fixed firmware, workarounds, and operational constraints.
  • Prioritize vendor-directed remediation for RTU500 units meeting all exposure preconditions.
  • Limit network reachability to RTU500 IEC 60870-5-104 services where operationally feasible.
  • Avoid configuration changes in production OT without vendor and operations approval.

Validation and detection

  • Inventory RTU500 CMU firmware versions across substations and OT sites.
  • Confirm whether HCI IEC 60870-5-104 is configured with IEC 62351-5 support.
  • Verify whether the Advanced security license feature is present on each CMU.
  • Review availability logs for unexpected CMU reboots without attempting crafted-message testing.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-2502 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2022-2502Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Hitachi EnergyRTU500 seriesRTU500 series CMU Firmware version 13.3.1, RTU500 series CMU Firmware version 13.3.2, RTU500 series CMU Firmware version 13.3.3, RTU500 series CMU Firmware version 13.4.1unaffected
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-20 · source CWE mapping

Improper Input Validation

Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs