CVE-2022-2513

hitachienergy 650connectivitypackage, hitachienergy 670connectivitypackage, hitachienergy gms600connectivitypackage +3 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-2513

Katalog CVE

CVSS 5.5 · Medium EPSS 0,15%

Kerentanan Cleartext Storage of Sensitive Information pada hitachienergy 650connectivitypackage, hitachienergy 670connectivitypackage +4 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An attacker having get access to the exported backup file can exploit the vulnerability and obtain user credentials of the IEDs. Additionally, an attacker with administrator access to the PCM600 host machine can obtain other user credentials by analyzing database log files. The credentials may be used to perform unauthorized modifications such as loading incorrect configurations, reboot the IEDs or cause a denial-of-service on the IEDs.

Rincian

Terbit di NVD
22 November 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-312: Cleartext Storage of Sensitive Information
EPSS (30 hari)
0,15% peluang dieksploitasi; lebih tinggi dari 3,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
hitachienergy 650connectivitypackage Versi 1.3.0
hitachienergy 650connectivitypackage Versi 2.1.2
hitachienergy 650connectivitypackage Versi 2.2.2
hitachienergy 650connectivitypackage Versi 2.3.0
hitachienergy 650connectivitypackage Versi 2.4.1
hitachienergy 670connectivitypackage Versi 3.0.2
hitachienergy 670connectivitypackage Versi 3.1.2
hitachienergy 670connectivitypackage Versi 3.2.6
hitachienergy 670connectivitypackage Versi 3.3.0
hitachienergy 670connectivitypackage Versi 3.4.1
hitachienergy gms600connectivitypackage Versi 1.3.0
hitachienergy gms600connectivitypackage Versi 1.3.1
hitachienergy pcm600 Semua versi hingga 2.11
hitachienergy pwc600connectivitypackage Versi 1.1.0
hitachienergy pwc600connectivitypackage Versi 1.1.1
hitachienergy pwc600connectivitypackage Versi 1.1.2
hitachienergy pwc600connectivitypackage Versi 1.2.0
hitachienergy pwc600connectivitypackage Versi 1.3.0
hitachienergy sam600ioconnectivitypackage Versi 1.0.0
hitachienergy sam600ioconnectivitypackage Versi 1.1.0
hitachienergy sam600ioconnectivitypackage Versi 1.2.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.