A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above.

published 2024-01-04 2 y ago modified 2026-06-17 4 mo ago also EUVD-2022-34371

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-235-07 updated 2022-08-23 cvss 7.5

Hitachi Energy RTU500

Hitachi Energy RTU500 series CMU 12.4.1-12.4.11, 12.7.1-12.7.3, 12.6.1-12.6.7, 13.2.1-13.2.4
affected: vendor fix, mitigation “Users should see Hitachi Energy advisory 8DBD000111 for additional mitigation and update information.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-01-04)

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Hitachi Energy RTU500 series CMU firmware

Classification

Weakness

CWE-787 Out-of-bounds Write

References

publisher.hitachienergy.com /preview?DocumentID=8DBD000111&LanguageCode=en&DocumentPartId=&Action=Launch
vendor-advisory

Sources

CVE List CVE-2022-2081
NVD CVE-2022-2081

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary