« Volver al listado

CVE-2024-10037

Estado: AplazadaMedia (5.9)—

A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection. An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability.

The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

ABB — Rtu500AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-10037",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-10037",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-31T16:16:55.447930Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@hitachienergy.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.7
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cybersecurity@hitachienergy.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "AUTOMATIC",
          "baseScore": 5.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@hitachienergy.com",
      "affectedData": [
        {
          "vendor": "Hitachi Energy",
          "product": "RTU500",
          "versions": [
            {
              "status": "affected",
              "version": "12.0.1",
              "versionType": "custom",
              "lessThanOrEqual": "12.0.14"
            },
            {
              "status": "affected",
              "version": "12.2.1",
              "versionType": "custom",
              "lessThanOrEqual": "12.2.12"
            },
            {
              "status": "affected",
              "version": "12.4.1",
              "versionType": "custom",
              "lessThanOrEqual": "12.4.11"
            },
            {
              "status": "affected",
              "version": "12.6.1",
              "versionType": "custom",
              "lessThanOrEqual": "12.6.10"
            },
            {
              "status": "affected",
              "version": "12.7.1",
              "versionType": "custom",
              "lessThanOrEqual": "12.7.7"
            },
            {
              "status": "affected",
              "version": "13.2.1",
              "versionType": "custom",
              "lessThanOrEqual": "13.2.7"
            },
            {
              "status": "affected",
              "version": "13.4.1",
              "versionType": "custom",
              "lessThanOrEqual": "13.4.4"
            },
            {
              "status": "affected",
              "version": "13.5.1",
              "versionType": "custom",
              "lessThanOrEqual": "13.5.3"
            },
            {
              "status": "affected",
              "version": "13.6.1"
            },
            {
              "status": "unaffected",
              "version": "12.7.8"
            },
            {
              "status": "unaffected",
              "version": "13.7.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-25T13:15:39.673",
  "references": [
    {
      "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true",
      "source": "cybersecurity@hitachienergy.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@hitachienergy.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection.\nAn attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability.\n\nThe affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad en el componente de servidor web RTU500 que puede causar una denegación de servicio a la aplicación CMU RTU500 si se ejecuta una secuencia de mensajes especialmente manipulada en una conexión WebSocket. Para explotar esta vulnerabilidad, un atacante debe estar correctamente autenticado y tener habilitada la función de modo de prueba de RTU500. La CMU afectada se recuperará automáticamente si un atacante la explota con éxito."
    }
  ],
  "lastModified": "2026-06-17T06:54:48.883",
  "sourceIdentifier": "cybersecurity@hitachienergy.com"
}