Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series

published 2022-05-02 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-33055

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits: 0; none known

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.

Patch / fix

fixed in 2

abb rtu500_firmware 12.2.12.0
hitachienergy rtu500_firmware 12.0.14.0, 12.4.12.0, 12.6.8.0, 12.7.4.0, 13.2.5.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-242-04 updated 2022-08-30 cvss 7.5

Hitachi Energy RTU500 series

Hitachi Energy RTU500 series CMU Firmware 12.2, 12.6, 12.7, 12.0
affected: mitigation “RTU500 series CMU: firmware version 12.0.1.0-12.0.13.0: Update to version 12.0.14.0 or higher.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	7.8	AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

Hitachi Energy RTU500 series CMU Firmware

Classification

Weakness

CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

CVE List CVE-2022-28613
NVD CVE-2022-28613

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary