Hitachi Energy RTU500 Series Overview

Hitachi Energy RTU500 Series Overview: A Comprehensive Analysis of Vulnerabilities and Mitigations

1. EXECUTIVE SUMMARY

The Hitachi Energy RTU500 series, particularly the B&R APROL software, has been identified with multiple vulnerabilities that pose significant risks to users and critical infrastructure. The vulnerabilities range from remote exploitation capabilities to improper handling of permissions, with a CVSS v4 score of 9.2 indicating a high level of severity. This report provides a detailed analysis of the vulnerabilities, their potential impacts, and recommended mitigations to enhance security.

• CVSS v4 9.2: Indicates a critical vulnerability level.
• ATTENTION: Vulnerabilities are exploitable remotely with low attack complexity.
• Vendor: B&R Automation, a subsidiary of Hitachi Energy.
• Equipment: APROL software platform.
• Vulnerabilities: Include issues such as code injection, improper permissions, and exposure of sensitive information.

2. RISK EVALUATION

The successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands, elevate privileges, gather sensitive information, or alter the functionality of the product. This poses a significant risk not only to the integrity of the systems involved but also to the broader critical infrastructure sectors that rely on these technologies.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

B&R has reported that the following versions of the APROL software are affected:

• B&R APROL: All versions prior to 4.4-01 (CVE-2024-45483, CVE-2024-10209).
• B&R APROL: All versions 4.4-00P1 and prior (CVE-2024-45482).
• B&R APROL: All versions 4.4-00P5 and prior (CVE-2024-45481, CVE-2024-45480, CVE-2024-8315, CVE-2024-45484, CVE-2024-8313, CVE-2024-8314, CVE-2024-10206, CVE-2024-10207, CVE-2024-10208, CVE-2024-10210).

3.2 VULNERABILITY OVERVIEW

The vulnerabilities identified in the B&R APROL software can be categorized as follows:

3.2.1 Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

This vulnerability allows an authenticated local attacker from a trusted remote server to execute malicious commands. The CVSS v3 base score is 7.8, with a CVSS v4 score of 8.5.

3.2.2 Incomplete Filtering of Special Elements (CWE-791)

This vulnerability may allow an authenticated local attacker to authenticate as another legitimate user. The CVSS v3 base score is 7.8, with a CVSS v4 score of 8.5.

3.2.3 Improper Control of Generation of Code (‘Code Injection’) (CWE-94)

This vulnerability allows an unauthenticated network-based attacker to read files from the local system. The CVSS v3 base score is 8.6, with a CVSS v4 score of 9.2.

3.2.4 Improper Handling of Insufficient Permissions or Privileges (CWE-280)

This vulnerability may allow an authenticated local attacker to read credential information. The CVSS v3 base score is 5.5, with a CVSS v4 score of 6.8.

3.2.5 Allocation of Resources Without Limits or Throttling (CWE-770)

This vulnerability may allow an unauthenticated adjacent attacker to perform Denial-of-Service (DoS) attacks. The CVSS v3 base score is 7.6, with a CVSS v4 score of 7.2.

3.2.6 Missing Authentication for Critical Function (CWE-306)

This vulnerability allows an unauthenticated physical attacker to alter the boot configuration of the operating system. The CVSS v3 base score is 6.8, with a CVSS v4 score of 7.0.

3.2.7 Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

This vulnerability may allow an unauthenticated adjacent-based attacker to read and alter configuration using SNMP. The CVSS v3 base score is 8.8, with a CVSS v4 score of 8.7.

3.2.8 Exposure of Data Element to Wrong Session (CWE-488)

This vulnerability may allow an authenticated network attacker to take over a currently active user session without login credentials. The CVSS v3 base score is 8.0, with a CVSS v4 score of 5.5.

3.2.9 Server-Side Request Forgery (SSRF) (CWE-918)

This vulnerability may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs. The CVSS v3 base score is 5.3, with a CVSS v4 score of 6.9.

3.2.10 Server-Side Request Forgery (SSRF) (CWE-918)

This vulnerability may allow an authenticated network-based attacker to force the web server to request arbitrary URLs. The CVSS v3 base score is 4.3, with a CVSS v4 score of 5.3.

3.2.11 Improper Neutralization of Input During Web Page Generation (‘Cross-Site Scripting’) (CWE-79)

This vulnerability may allow an authenticated network-based attacker to insert malicious code executed in the context of the user’s browser session. The CVSS v3 base score is 6.1, with a CVSS v4 score of 5.1.

3.2.12 External Control of File Name or Path (CWE-73)

This vulnerability may allow an authenticated network-based attacker to access data from the file system.