{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2617", "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17", "state": "PUBLISHED", "assignerShortName": "Hitachi Energy", "dateReserved": "2024-03-18T17:44:43.352Z", "datePublished": "2024-04-30T12:57:37.143Z", "dateUpdated": "2024-08-01T19:18:48.011Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "RTU500 series CMU firmware", "vendor": "Hitachi Energy", "versions": [{"lessThanOrEqual": "13.2.7", "status": "affected", "version": "13.2.1", "versionType": "custom"}, {"lessThanOrEqual": "13.4.4", "status": "affected", "version": "13.4.1", "versionType": "custom"}, {"lessThanOrEqual": "13.5.3", "status": "affected", "version": "13.5.1", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nA vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update. If a\nmalicious actor successfully exploits this vulnerability, they\ncould use it to update the RTU500 with unsigned firmware.\n\n"}], "value": "\nA vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update. If a\nmalicious actor successfully exploits this vulnerability, they\ncould use it to update the RTU500 with unsigned firmware.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "e383dce4-0c27-4495-91c4-0db157728d17", "shortName": "Hitachi Energy", "dateUpdated": "2024-04-30T12:57:37.143Z"}, "references": [{"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000199&languageCode=en&Preview=true"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-30T16:11:48.392692Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:hitachienergy:rtu500_firmware:13.2.1.0:*:*:*:*:*:*:*"], "vendor": "hitachienergy", "product": "rtu500_firmware", "versions": [{"status": "affected", "version": "13.2.1.0", "versionType": "custom", "lessThanOrEqual": "13.2.7.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:hitachienergy:rtu500_firmware:13.4.1.0:*:*:*:*:*:*:*"], "vendor": "hitachienergy", "product": "rtu500_firmware", "versions": [{"status": "affected", "version": "13.4.1.0", "versionType": "custom", "lessThanOrEqual": "13.4.4.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:hitachienergy:rtu500_firmware:13.5.1.0:*:*:*:*:*:*:*"], "vendor": "hitachienergy", "product": "rtu500_firmware", "versions": [{"status": "affected", "version": "13.5.1.0", "versionType": "custom", "lessThanOrEqual": "13.5.3.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-358", "description": "CWE-358 Improperly Implemented Security Check for Standard"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:29:04.729Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:18:48.011Z"}, "title": "CVE Program Container", "references": [{"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000199&languageCode=en&Preview=true", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000199&languageCode=en&Preview=true", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:18:48.011Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-30T16:11:48.392692Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:hitachienergy:rtu500_firmware:13.2.1.0:*:*:*:*:*:*:*"], "vendor": "hitachienergy", "product": "rtu500_firmware", "versions": [{"status": "affected", "version": "13.2.1.0", "versionType": "custom", "lessThanOrEqual": "13.2.7.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:hitachienergy:rtu500_firmware:13.4.1.0:*:*:*:*:*:*:*"], "vendor": "hitachienergy", "product": "rtu500_firmware", "versions": [{"status": "affected", "version": "13.4.1.0", "versionType": "custom", "lessThanOrEqual": "13.4.4.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:hitachienergy:rtu500_firmware:13.5.1.0:*:*:*:*:*:*:*"], "vendor": "hitachienergy", "product": "rtu500_firmware", "versions": [{"status": "affected", "version": "13.5.1.0", "versionType": "custom", "lessThanOrEqual": "13.5.3.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-358", "description": "CWE-358 Improperly Implemented Security Check for Standard"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-30T16:07:24.339Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hitachi Energy", "product": "RTU500 series CMU firmware", "versions": [{"status": "affected", "version": "13.2.1", "versionType": "custom", "lessThanOrEqual": "13.2.7"}, {"status": "affected", "version": "13.4.1", "versionType": "custom", "lessThanOrEqual": "13.4.4"}, {"status": "affected", "version": "13.5.1", "versionType": "custom", "lessThanOrEqual": "13.5.3"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000199&languageCode=en&Preview=true"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nA vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update. If a\nmalicious actor successfully exploits this vulnerability, they\ncould use it to update the RTU500 with unsigned firmware.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\nA vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update. If a\nmalicious actor successfully exploits this vulnerability, they\ncould use it to update the RTU500 with unsigned firmware.\n\n", "base64": false}]}], "providerMetadata": {"orgId": "e383dce4-0c27-4495-91c4-0db157728d17", "shortName": "Hitachi Energy", "dateUpdated": "2024-04-30T12:57:37.143Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2617", "state": "PUBLISHED", "dateUpdated": "2024-08-01T19:18:48.011Z", "dateReserved": "2024-03-18T17:44:43.352Z", "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17", "datePublished": "2024-04-30T12:57:37.143Z", "assignerShortName": "Hitachi Energy"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "\nA vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update. If a\nmalicious actor successfully exploits this vulnerability, they\ncould use it to update the RTU500 with unsigned firmware.\n\n"}, {"lang": "es", "value": "Existe una vulnerabilidad en el RTU500 que permite a los usuarios autenticados y autorizados omitir la actualizaci\u00f3n segura. Si un actor malintencionado aprovecha con \u00e9xito esta vulnerabilidad, podr\u00eda usarla para actualizar el RTU500 con firmware sin firmar."}], "id": "CVE-2024-2617", "lastModified": "2024-11-21T09:10:08.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "cybersecurity@hitachienergy.com", "type": "Secondary"}]}, "published": "2024-04-30T13:15:47.200", "references": [{"source": "cybersecurity@hitachienergy.com", "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000199&languageCode=en&Preview=true"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000199&languageCode=en&Preview=true"}], "sourceIdentifier": "cybersecurity@hitachienergy.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-358"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}