Detections
Analytics

Hitachi Energy's RTU500 series NULL Pointer Deference (CVE-2024-11499)

medium Tenable OT Security Plugin ID 503160

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability exists in RTU500 IEC 60870-4-104 con- trolled station functionality, that allows an authenti- cated and authorized attacker to perform a CMU re- start. The vulnerability can be triggered if certificates are updated while in use on active connections.
The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Hitachi Energy has identified the following specific workarounds and mitigations users can apply to reduce risk:

- For all versions, apply general mitigation factors/workarounds. Upgrade the system once remediated version is available, or apply general mitigation factors.
- RTU500 series CMU 12.0.1 - 12.0.14, 12.2.1 - 12.2.12, 12.4.1 - 12.4.11, 12.6.1 - 12.6.10, 12.7.1 - 12.7.7: Update to version 12.7.8 when available.
- RTU500 series CMU version 13.2.1 - 13.2.7, 13.4.1 - 13.4.4, 13.5.1 - 13.5.3, 13.6.1: Update to version 13.7.1
- RTU500 series CMU 13.5.1 - 13.5.3: Update to version 13.5.4 when available.
- RTU500 series CMU 13.6.1: Update to version 13.6.2 when available.
- (CVE-2024-11499, CVE-2025-1445) RTU500 series CMU 13.7.1 - 13.7.4: Update to version 13.7.6 when available.
- (CVE-2024-12169) RTU500 series CMU 13.4.1 - 13.4.4, 13.5.1 - 13.5.3, 13.6.1, 13.7.1 - 13.7.4: Update to version 13.7.6 when available.

For more information see the associated Hitachi Energy PSIRT security advisory 8DBD000207.

Hitachi Energy recommends users implement recommended security practices and firewall configurations to help protect the process control network from attacks originating from outside the network. Process control systems should be physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and be separated from other networks by means of a firewall system with a minimal number of ports exposed. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.
Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

For more information, see Hitachi Energy's Security Advisories.

See Also

http://www.nessus.org/u?5910065f

https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-01

Plugin Details

Severity: Medium

ID: 503160

Version: 1.1

Type: remote

Family: Tenable.ot

Published: 4/14/2025

Updated: 4/14/2025

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v3

Risk Factor: Medium

Base Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:hitachienergy:rtu500_firmware

Required KB Items: Tenable.ot/ABB

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/25/2025

Reference Information

CVE: CVE-2024-11499

CWE: 476

ICSA: 25-093-01