CVE-2022-2502 is a missing input validation flaw (CWE-20) in the HCI IEC 60870-5-104 telecontrol function of Hitachi Energy's RTU500 series substation RTU: a remote attacker can send a specially crafted IEC 60870-5-104 message that overflows an internal buffer and reboots the RTU's CMU, but only when the unit's HCI interface is configured with IEC 62351-5 support and has the separately-licensed 'Advanced security' feature enabled, and NVD rates the resulting denial-of-service impact 7.5 (high) on CVSS v3.1.
Vulnerability summary
7.5
High
0.6%
EPSS score (FIRST)
No
CISA KEV catalog
2023-07-26
Published
Vulnerability ID: CVE-2022-2502 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Hitachi Energy RTU500 series CMU (Remote Terminal Unit) firmware | cpe:2.3:o:hitachienergy:rtu500_firmware:*:*:*:*:*:*:*:* | RTU500 series CMU firmware 13.3.1, 13.3.2, 13.3.3 and 13.4.1, when the HCI IEC 60870-5-104 function is configured with IEC 62351-5 support and the separately-ordered 'Advanced security' licence feature is enabled, per NVD |
What does this mean for affected devices?
CVE-2022-2502 (CWE-20, missing input data validation) affects the RTU500 series, Hitachi Energy's remote terminal unit product line used to connect substation protection, control and telemetry equipment to a utility's SCADA master station over protocols including IEC 60870-5-104.
NVD's description states: "A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-5 and the CMU contains the license feature 'Advanced security' which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation which eventually if exploited causes an internal buffer to overflow in the HCI IEC 60870-5-104 function" (NVD).
NVD records a Primary CVSS v3.1 score of 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with an availability-only impact consistent with a forced reboot rather than data theft or tampering; Hitachi Energy's own PSIRT submission to NVD carries the identical score and vector as a Secondary rating (NVD).
The flaw is tracked in CISA's ICS advisory ICSA-23-220-02 ("Hitachi Energy RTU500 series"), which the advisory and NVD both list as a Patch / Third Party Advisory / US Government Resource reference, alongside Hitachi Energy's own Cyber Security Advisory 8DBD000121 (CISA ICSA-23-220-02, Hitachi Energy Cyber Security Advisory 8DBD000121).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.645% (51.2th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Operators running an affected RTU500 CMU with the IEC 62351-5 'Advanced security' licence enabled on its IEC 60870-5-104 interface should apply Hitachi Energy's firmware remediation per the advisory, since a successful attack reboots the unit that carries telecontrol traffic between the substation and the SCADA master station.
Evidence
- A vulnerability exists in the HCI IEC 60870-5-104 function of the RTU500 series; exploitable only when the HCI interface is configured with IEC 62351-5 support and the separately-ordered 'Advanced security' licence feature, causing a missing-input-validation internal buffer overflow that reboots the targeted CMU. — NVD
- NVD Primary CVSS v3.1 score 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; Hitachi Energy's own PSIRT submission carries an identical Secondary score and vector. — NVD
- CVE-2022-2502 is documented in CISA ICS advisory ICSA-23-220-02, "Hitachi Energy RTU500 series", affecting the energy critical infrastructure sector with worldwide deployment. — CISA ICSA-23-220-02
- Hitachi Energy published its own Cyber Security Advisory (document 8DBD000121) covering this RTU500 series vulnerability, cited by NVD as a vendor reference. — Hitachi Energy Cyber Security Advisory 8DBD000121
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.645% (51.2th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What has to be configured on an RTU500 for CVE-2022-2502 to be exploitable?
The HCI IEC 60870-5-104 interface must be configured with IEC 62351-5 support, and the CMU must carry the separately-ordered 'Advanced security' licence feature; RTU500 units without that interface configuration or licence are not exposed to this specific flaw (per NVD).
What does a successful attack actually do to the RTU?
A specially crafted IEC 60870-5-104 message overflows an internal buffer caused by missing input validation, forcing the targeted RTU500 CMU to reboot — an availability-only impact, matching NVD's confidentiality:none / integrity:none / availability:high scoring (per NVD).
Does exploiting this require authentication?
No. NVD's vector shows no privileges required (PR:N) and no user interaction (UI:N), so a remote, unauthenticated attacker who can reach the configured HCI interface can trigger the reboot directly (per NVD).
Why does a CMU reboot matter for a substation?
The RTU500 series carries telecontrol traffic — status, measurements and control commands — between substation equipment and the utility's SCADA master station over IEC 60870-5-104; a forced CMU reboot interrupts that link for the duration of the restart, which is why CISA tracks this under the energy critical infrastructure sector with worldwide deployment (per CISA ICSA-23-220-02).