CVE-2023-4518

MEDIUM

Hitachi Energy RELION 670/650/SAM600-IO Firmware - Denial of Service via GOOSE Message Input Validation

Title source: llm

Description

A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.

References (1)

Core 1

Core References

Vendor Advisory

https://publisher.hitachienergy.com/preview?DocumentId=8DBD000170&languageCode=en&Preview=true

Scores

CVSS v3 6.5

EPSS 0.0070

EPSS Percentile 48.2%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-1284

Status published

Products (7)

hitachienergy/relion_650_firmware 2.2.1

hitachienergy/relion_650_firmware 2.2.1.6

hitachienergy/relion_650_firmware 2.2.4 - 2.2.4.4

hitachienergy/relion_670_firmware 2.2.0 - 2.2.2.6

hitachienergy/relion_sam600-io_firmware 2.2.1

hitachienergy/relion_sam600-io_firmware 2.2.1.6

hitachienergy/relion_sam600-io_firmware 2.2.5 - 2.2.5.6

Published Dec 01, 2023

Tracked Since Feb 18, 2026