CVE-2023-4518 : A vulnerability exists in the input validation of the GOOSE messages where out

A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.

Published 2023-12-01 15:15:08

Updated 2024-09-23 13:15:04

Source Hitachi Energy

View at NVD, CVE.org

Products affected by CVE-2023-4518

Hitachienergy » Relion Sam600-io Firmware
Versions from including (>=) 2.2.5 and before (<) 2.2.5.6
cpe:2.3:o:hitachienergy:relion_sam600-io_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion Sam600-io » Version: N/A
Hitachienergy » Relion Sam600-io Firmware » Version: 2.2.1
cpe:2.3:o:hitachienergy:relion_sam600-io_firmware:2.2.1:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion Sam600-io » Version: N/A
Hitachienergy » Relion Sam600-io Firmware » Version: 2.2.1.6
cpe:2.3:o:hitachienergy:relion_sam600-io_firmware:2.2.1.6:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion Sam600-io » Version: N/A
Hitachienergy » Relion 650 Firmware
Versions from including (>=) 2.2.4 and before (<) 2.2.4.4
cpe:2.3:o:hitachienergy:relion_650_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion 650 » Version: N/A
Hitachienergy » Relion 650 Firmware
Versions from including (>=) 2.2.5 and before (<) 2.2.5.6
cpe:2.3:o:hitachienergy:relion_650_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion 650 » Version: N/A
Hitachienergy » Relion 650 Firmware » Version: 2.2.1
cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.1:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion 650 » Version: N/A
Hitachienergy » Relion 650 Firmware » Version: 2.2.1.6
cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.1.6:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion 650 » Version: N/A
Hitachienergy » Relion 670 Firmware
Versions from including (>=) 2.2.0 and before (<) 2.2.2.6
cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion 670 » Version: N/A
Hitachienergy » Relion 670 Firmware
Versions from including (>=) 2.2.3 and before (<) 2.2.3.7
cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion 670 » Version: N/A
Hitachienergy » Relion 670 Firmware
Versions from including (>=) 2.2.4 and before (<) 2.2.4.4
cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion 670 » Version: N/A
Hitachienergy » Relion 670 Firmware
Versions from including (>=) 2.2.5 and before (<) 2.2.5.6
cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Relion 670 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-4518

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-4518

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	2.8	3.6	Hitachi Energy
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-4518

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: cybersecurity@hitachienergy.com (Secondary)
CWE-1284 Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Assigned by:
- cybersecurity@hitachienergy.com (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2023-4518

https://publisher.hitachienergy.com/preview?DocumentId=8DBD000170&languageCode=en&Preview=true

Hitachi Energy Publisher
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-4518

Products affected by CVE-2023-4518

Exploit prediction scoring system (EPSS) score for CVE-2023-4518

CVSS scores for CVE-2023-4518

CWE ids for CVE-2023-4518

References for CVE-2023-4518