The vulnerabilities are NULL pointer dereference, improper validation of integrity check value, improper restriction of XML external entity reference, heap-based buffer overflow, integer overflow or wraparound, improper restriction of recursive entity references in DTDs (XML entity expansion), and stack-based buffer overflow.
Successful exploitation of these remotely exploitable vulnerabilities, which Hitachi self-reported, could cause a Denial-of-Service condition in RTU500 devices.
Hitachi Energy reports the following products suffer from the vulnerabilities:
- Hitachi Energy RTU500 series: Version 13.6.1 (CVE-2023-2953, CVE-2025-39203, CVE-2025-6021)
- Hitachi Energy RTU500 series: Versions 12.7.1 through 12.7.7 (CVE-2023-2953, CVE-2025-39203, CVE-2025-6021)
- Hitachi Energy RTU500 series: Versions 13.4.1 through 13.4.4 (CVE-2025-39203)
- Hitachi Energy RTU500 series: Versions 13.5.1 through 13.5.3 (CVE-2023-2953, CVE-2025-39203, CVE-2025-6021)
- Hitachi Energy RTU500 series: Versions 13.7.1 through 13.7.6
In one issue, a vulnerability has been identified in the openLDAP library used in Central Account Management (CAM) client. This issue can lead to a Denial of Service (DoS) condition when a specially crafted request may cause a null pointer to dereference, resulting in affected CMU to automatically recovering itself by rebooting.
CVE-2023-2953 is the case number for this vulnerability, which has a CVSS v3.1 base score of 7.5. There is also a CVSS v4 base score of 8.2.
Another Vulnerability
Additionally, a vulnerability exists in the IEC 61850 protocol of the RTU500 product series. An IEC 61850-8 crafted message content from a device (e.g. an IED) or remote system can cause a Denial of Service (DoS) resulting in disconnection of the device to the RTU 500 until next reboot.
CVE-2025-39203 is the case number for this vulnerability, which has a CVSS v3.1 base score of 4.3. There is also a CVSS v4 base score of 5.3.
Also, there is a vulnerability in the libexpat library used in IEC 61850 client and server components of the RTU500 product series. An authenticated and authorized malicious user could load a crafted XML input which may lead to memory mismanagement potentially causing RTU500 to reboot.
CVE-2024-45490 is the case number for this vulnerability, which has a CVSS v3.1 base score of 6.5. There is also a CVSS v4 base score of 7.1.
Meanwhile, there is a vulnerability in libexpat library used in the IEC 61850 client and server components of the RTU500 product series. An authenticated and authorized malicious user could load a crafted XML input which may lead to heap corruption potentially causing RTU500 to reboot.
CVE-2024-45491 is the case number for this vulnerability, which has a CVSS v3.1 base score of 6.5. There is also a CVSS v4 base score of 7.1.
Furthermore, there is a vulnerability in libexpat library used in the IEC 61850 client and server components of the RTU500 product series. An authenticated and authorized malicious user could load a crafted XML input which leads to an integer overflow potentially causing RTU500 to reboot.
CVE-2024-45492 is the case number for this vulnerability, which has a CVSS v3.1 base score of 6.5. There is also a CVSS v4 base score of 7.1.
Possible Reboot
Moreover, there is a vulnerability in libexpat library used in the IEC 61850 client and server components of the RTU500 product series. An authenticated and authorized malicious user could load a crafted XML input which may lead to a memory mismanagement potentially causing RTU500 to reboot.
CVE-2024-28757 is the case number for this vulnerability, which has a CVSS v3.1 base score of 6.5. There is also a CVSS v4 base score of 7.1.
In another issue, a vulnerability exists in libxml library used by RTU500 Web server functionality. An authenticated and authorized malicious user could send a crafted XML message which may lead to buffer overflow potentially causing RTU500 to reboot.
CVE-2025-6021 is the case number for this vulnerability, which has a CVSS v3.1 base score of 6.5. There is also a CVSS v4 base score of 6.9.
The product sees use mainly in the energy sector, and on a global basis.
No exploitation targets these vulnerabilities. However, an attacker could leverage these low complexity vulnerabilities.
Mitigations
Hitachi Energy identified the following specific workarounds and mitigations users can apply to reduce risk:
- (CVE-2023-2953, CVE-2025-39203, CVE-2025-6021) RTU500 series CMU Firmware version 12.7.1 – 12.7.7: Update to CMU Firmware version 12.7.8 when available
- (CVE-2023-2953, CVE-2025-39203, CVE-2025-6021) RTU500 series CMU Firmware version 13.5.1 – 13.5.3: Update to CMU Firmware version 13.5.4
- (CVE-2023-2953, CVE-2025-39203, CVE-2025-6021) RTU500 series CMU Firmware version 13.6.1: Update to CMU Firmware version 13.6.3
- (CVE-2023-2953) RTU500 series CMU Firmware version 12.7.1 – 12.7.7: Follow general mitigation factors /workarounds
- (CVE-2023-2953, CVE-2025-39203) RTU500 series CMU Firmware version 13.6.1, RTU500 series CMU Firmware version 13.5.1 – 13.5.3, RTU500 series CMU Firmware version 13.7.1 – 13.7.6: Follow general mitigation factors/workarounds
- (CVE-2023-2953, CVE-2024-45490, CVE-2024-45491, CVE-2024-45492, CVE-2024-28757, CVE-2025-6021) RTU500 series CMU Firmware version 13.7.1 – 13.7.6: Update to CMU Firmware version 13.7.7
- (CVE-2025-39203) RTU500 series CMU Firmware version 12.7.1 – 12.7.7: Follow general mitigation factors/ workarounds
- (CVE-2025-39203) RTU500 series CMU Firmware version 13.4.1 – 13.4.4, RTU500 series CMU Firmware version 13.7.1 – 13.7.6: Update to CMU Firmware version 13.7.7
- (CVE-2025-39203) RTU500 series CMU Firmware version 13.4.1 – 13.4.4: Follow General Mitigation Factors/Workarounds
- (CVE-2024-45490, CVE-2024-45491, CVE-2024-45492, CVE-2024-28757) RTU500 series CMU Firmware version 13.7.1 – 13.7.6: Follow general mitigation factors/workarounds
- (CVE-2025-6021) RTU500 series CMU Firmware version 13.6.1, RTU500 series CMU Firmware version 12.7.1 – 12.7.7, RTU500 series CMU Firmware version 13.5.1 – 13.5.3, RTU500 series CMU Firmware version 13.7.1 – 13.7.6: Follow general mitigation factors/workarounds
For more information click on the associated Hitachi Energy PSIRT security advisory 8DBD000220 Multiple Vulnerabilities in Hitachi Energy’s RTU500 series Product.