IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products
Published Feb 21, 2023
7.5
HIGHCVSS 3.1
EPSS 1.10%
Description
A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products.
An attacker could exploit the vulnerability by using a specially crafted message sequence, to force the IEC 61850 MMS-server communication stack, to stop accepting new MMS-client connections.
Already existing/established client-server connections are not affected.
List of affected CPEs:
* cpe:2.3:o:hitachienergy:fox61x_tego1:r15b08:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16_3:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r2a16:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1e01:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1d02:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1c07:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:fox61x_tego1:r1b02:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:gms600:1.3.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.1.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.5.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.6.0.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.7.2:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:1.8.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.0.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.4:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.5:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:mms:2.2.3:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.2:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:reb500:7:*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:reb500:8:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:1.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.0.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:1.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:1.3.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:2.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.1:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.5:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:2.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:rtu500cmu:12.*.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:rtu500cmu:13.*.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:2.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:3.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_5:3.0:*:*:*:*:*:*:*
Affected products
-
- Version tego1_r15b08StatusaffectedConstraints-
- Version tego1_r1b02StatusaffectedConstraints-
- Version tego1_r1c07StatusaffectedConstraints-
- Version tego1_r1d02StatusaffectedConstraints-
- Version tego1_r1e01StatusaffectedConstraints-
- Version tego1_r2a16StatusaffectedConstraints-
- Version tego1_r2a16_03StatusaffectedConstraints-
- Version tego1_r16a11StatusunaffectedConstraints-
- Version
-
- Version GMS600 1.3StatusaffectedConstraints-
- Version
-
- Version ITT600 SA Explorer 1.1.0StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.1.1StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.1.2StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.5.0StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.5.1StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.6.0StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.6.0.1StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.7.0StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.7.2StatusaffectedConstraints-
- Version ITT600 SA Explorer 1.8.0StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.0.1StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.0.2StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.0.3StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.0.4.1StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.0.5.0StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.0.5.4StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.1.0.4StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.1.0.5StatusaffectedConstraints-
- Version ITT600 SA Explorer 2.1.1.2StatusunaffectedConstraints-
- Version
-
- Version MSM 2.2.3;0StatusaffectedConstraints-
- Version
-
- Version SYS600 10StatusaffectedConstraints-
- Version SYS600 10.1StatusaffectedConstraints-
- Version SYS600 10.1.1StatusaffectedConstraints-
- Version SYS600 10.2StatusaffectedConstraints-
- Version SYS600 10.2.1StatusaffectedConstraints-
- Version SYS600 10.3StatusaffectedConstraints-
- Version SYS600 10.3.1StatusaffectedConstraints-
- Version SYS600 10.4StatusaffectedConstraints-
- Version SYS600 10.4.1StatusunaffectedConstraints-
- Version
-
- Version PWC600 1.0StatusaffectedConstraints-
- Version PWC600 1.1StatusaffectedConstraints-
- Version PWC600 1.2StatusaffectedConstraints-
- Version
-
- Version REB500 7.0StatusaffectedConstraints<7.*
- Version REB500 8.0StatusaffectedConstraints<8.*
- Version REB500 8.3.3.0StatusunaffectedConstraints-
- Version
-
- Version RTU500 12.0.1StatusaffectedConstraints<=12.0.14
- Version RTU500 12.2.1StatusaffectedConstraints<=12.2.11
- Version RTU500 12.4.1StatusaffectedConstraints<=12.4.11
- Version RTU500 12.6.1StatusaffectedConstraints<=12.6.8
- Version RTU500 12.7.1StatusaffectedConstraints<=12.7.4
- Version RTU500 13.2.1StatusaffectedConstraints<=13.2.5
- Version RTU500 13.3.1StatusaffectedConstraints<=13.3.3
- Version RTU500 13.4.1StatusaffectedConstraints-
- Version RTU500 12.0.15StatusunaffectedConstraints-
- Version RTU500 12.2.12StatusunaffectedConstraints-
- Version RTU500 12.4.12StatusunaffectedConstraints-
- Version RTU500 12.6.9StatusunaffectedConstraints-
- Version RTU500 12.7.5StatusunaffectedConstraints-
- Version RTU500 13.2.6StatusunaffectedConstraints-
- Version RTU500 13.3.4StatusunaffectedConstraints-
- Version RTU500 13.4.2StatusunaffectedConstraints-
- Version
-
- Version Relion 650 1.1StatusaffectedConstraints-
- Version Relion 650 1.3StatusaffectedConstraints-
- Version Relion 650 2.1StatusaffectedConstraints-
- Version Relion 650 2.2.0StatusaffectedConstraints-
- Version Relion 650 2.2.1StatusaffectedConstraints-
- Version Relion 650 2.2.2StatusaffectedConstraints-
- Version Relion 650 2.2.3StatusaffectedConstraints-
- Version Relion 650 2.2.4StatusaffectedConstraints-
- Version Relion 650 2.2.5StatusaffectedConstraints-
- Version
-
- Version Relion 670 1.2StatusaffectedConstraints-
- Version Relion 670 2.0StatusaffectedConstraints-
- Version Relion 670 2.2.0StatusaffectedConstraints-
- Version Relion 670 2.2.1StatusaffectedConstraints-
- Version Relion 670 2.2.2StatusaffectedConstraints-
- Version Relion 670 2.2.3StatusaffectedConstraints-
- Version Relion 670 2.2.4StatusaffectedConstraints-
- Version Relion 670 2.2.5StatusaffectedConstraints-
- Version Relion 670 version 2.1StatusaffectedConstraints-
- Version
-
- Version Relion SAM600-IO 2.2.1StatusaffectedConstraints-
- Version Relion SAM600-IO 2.2.5StatusaffectedConstraints-
- Version
-
- Version CoreTec 4 version 2.0.*StatusaffectedConstraints-
- Version CoreTec 4 version 2.1.*StatusaffectedConstraints-
- Version CoreTec 4 version 2.2.*StatusaffectedConstraints-
- Version CoreTec 4 version 2.3.*StatusaffectedConstraints-
- Version CoreTec 4 version 2.4.*StatusaffectedConstraints-
- Version CoreTec 4 version 3.0.*StatusaffectedConstraints-
- Version
-
- Version CoreTec 5 version 3.0.*StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hitachi Energy | FOX61x TEGO1 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | GMS600 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | ITT600 SA Explorer | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | MSM | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | MicroSCADA X SYS600 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | PWC600 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | REB500 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | RTU500 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | Relion® 650 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | Relion® 670 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | Sam600-IO | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | TXpert Hub CoreTec 4 | unaffected |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Hitachi Energy | TXpert Hub CoreTec 5 | unaffected |
|
Configuration 1
- ≥ 10.1 · ≤ 10.3.1
Running on/with
- n/a
Configuration 2
- ≥ 12.0.1.0 · ≤ 12.0.14.0
- ≥ 12.2.1.0 · ≤ 12.2.11.0
- ≥ 12.4.1.0 · ≤ 12.4.11.0
- ≥ 12.6.1.0 · ≤ 12.6.8.0
- ≥ 12.7.1.0 · ≤ 12.7.4.0
- ≥ 13.2.1.0 · ≤ 13.2.5.0
- ≥ 13.3.1 · ≤ 13.3.3
- 13.4.1
Running on/with
- n/a
Configuration 3
- ≥ 7.0 · < 8.3.3
Running on/with
- n/a
Configuration 4
- 1.0
- 1.1
- 1.2
Running on/with
- n/a
Configuration 5
- ≤ 2.2.3
Running on/with
- n/a
Configuration 6
- 1.1.0
- 1.1.1
- 1.1.2
- 1.5.0
- 1.5.1
- 1.6.0
- 1.6.0.1
- 1.7.0
- 1.7.2
- 1.8.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4.1
- 2.0.5.0
- 2.0.5.4
- 2.1.0.4
- 2.1.0.5
Configuration 7
- 2.2.1
- 2.2.5
Running on/with
- n/a
Configuration 8
- 1.1
- 1.3
- 2.1
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
Running on/with
- n/a
Configuration 9
- 1.2
- 2.0
- 2.1
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
Running on/with
- n/a
Configuration 10
- 1.3.0
Running on/with
- n/a
Configuration 11
- r1b02
- r1c07
- r1d02
- r1e01
- r2b16
- r2b16_03
- r15b08
Running on/with
- n/a
Configuration 12
- ≥ 2.0.0 · ≤ 3.0.0
Running on/with
- n/a
Configuration 13
- 3.0.0
Running on/with
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Upgrade the system once remediated version is available.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1 other source (CVE.org) ▾
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Mar 12, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.
Score over time
2023-2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (12 key points)
Flat stretches are collapsed. Showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 4, 2026 | 1.10% (0.01105) | 64.62th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.10% (0.01105) | 61.38th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.33% (0.00331) | 53.83th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.93% (0.00930) | 83.67th | v3 (v2023.03.01) |
| May 28, 2024 | 0.53% (0.00525) | 76.88th | v3 (v2023.03.01) |
| Mar 25, 2024 | 0.44% (0.00436) | 74.17th | v3 (v2023.03.01) |
| Feb 28, 2024 | 0.37% (0.00366) | 71.78th | v3 (v2023.03.01) |
| Jan 22, 2024 | 0.18% (0.00182) | 55.55th | v3 (v2023.03.01) |
| Mar 22, 2023 | 0.13% (0.00128) | 45.85th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.04% (0.00044) | 10.68th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.54% (0.01537) | 74.52th | v2 (v2022.01.01) |
| Feb 22, 2023 | 1.54% (0.01537) | 74.26th | v2 (v2022.01.01) |
References (10)
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000124&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000125&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000126&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000127&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000128&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000129&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000130&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000131&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000132&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000133&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
Change history (0)
No recorded changes yet.