CVE-2022-2513
Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products
Severity Score
5.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An attacker having get access to the exported backup file can exploit the vulnerability and obtain user credentials of the IEDs. Additionally, an attacker with administrator access to the PCM600 host machine can obtain other user credentials by analyzing database log files. The credentials may be used to perform unauthorized modifications such as loading incorrect configurations, reboot the IEDs or cause a denial-of-service on the IEDs.
Existe una vulnerabilidad en Intelligent Electronic Device (IED) Connectivity Package (ConnPack) la función de almacenamiento de credenciales del producto PCM600 de Hitachi Energy incluido en las versiones que se enumeran a continuación, donde las credenciales de los IED se almacenan en un formato de texto plano en la base de datos PCM600. Un atacante que logre acceder al archivo de copia de seguridad exportado puede explotar la vulnerabilidad y obtener las credenciales de los IED. Las credenciales se pueden utilizar para realizar modificaciones no autorizadas, como cargar configuraciones incorrectas, reiniciar los IED o provocar una Denegación de Servicio (DoS) en los IED.
*Credits:
PSE - Polskie Sieci Elektroenergetyczne (Polish Power Grid Company (PPGC))
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-07-22 CVE Reserved
- 2022-11-22 CVE Published
- 2024-06-14 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-312: Cleartext Storage of Sensitive Information
CAPEC
- CAPEC-37: Retrieve Embedded Sensitive Data
References (1)
| URL | Tag | Source |
|---|---|---|
| https://publisher.hitachienergy.com/preview?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launch |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hitachienergy Search vendor "Hitachienergy" | 650connectivitypackage Search vendor "Hitachienergy" for product "650connectivitypackage" | 1.3.0 Search vendor "Hitachienergy" for product "650connectivitypackage" and version "1.3.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 650connectivitypackage Search vendor "Hitachienergy" for product "650connectivitypackage" | 2.1.2 Search vendor "Hitachienergy" for product "650connectivitypackage" and version "2.1.2" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 650connectivitypackage Search vendor "Hitachienergy" for product "650connectivitypackage" | 2.2.2 Search vendor "Hitachienergy" for product "650connectivitypackage" and version "2.2.2" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 650connectivitypackage Search vendor "Hitachienergy" for product "650connectivitypackage" | 2.3.0 Search vendor "Hitachienergy" for product "650connectivitypackage" and version "2.3.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 650connectivitypackage Search vendor "Hitachienergy" for product "650connectivitypackage" | 2.4.1 Search vendor "Hitachienergy" for product "650connectivitypackage" and version "2.4.1" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 670connectivitypackage Search vendor "Hitachienergy" for product "670connectivitypackage" | 3.0.2 Search vendor "Hitachienergy" for product "670connectivitypackage" and version "3.0.2" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 670connectivitypackage Search vendor "Hitachienergy" for product "670connectivitypackage" | 3.1.2 Search vendor "Hitachienergy" for product "670connectivitypackage" and version "3.1.2" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 670connectivitypackage Search vendor "Hitachienergy" for product "670connectivitypackage" | 3.2.6 Search vendor "Hitachienergy" for product "670connectivitypackage" and version "3.2.6" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 670connectivitypackage Search vendor "Hitachienergy" for product "670connectivitypackage" | 3.3.0 Search vendor "Hitachienergy" for product "670connectivitypackage" and version "3.3.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | 670connectivitypackage Search vendor "Hitachienergy" for product "670connectivitypackage" | 3.4.1 Search vendor "Hitachienergy" for product "670connectivitypackage" and version "3.4.1" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Gms600connectivitypackage Search vendor "Hitachienergy" for product "Gms600connectivitypackage" | 1.3.0 Search vendor "Hitachienergy" for product "Gms600connectivitypackage" and version "1.3.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Gms600connectivitypackage Search vendor "Hitachienergy" for product "Gms600connectivitypackage" | 1.3.1 Search vendor "Hitachienergy" for product "Gms600connectivitypackage" and version "1.3.1" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Pcm600 Search vendor "Hitachienergy" for product "Pcm600" | <= 2.11 Search vendor "Hitachienergy" for product "Pcm600" and version " <= 2.11" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Pwc600connectivitypackage Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" | 1.1.0 Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" and version "1.1.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Pwc600connectivitypackage Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" | 1.1.1 Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" and version "1.1.1" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Pwc600connectivitypackage Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" | 1.1.2 Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" and version "1.1.2" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Pwc600connectivitypackage Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" | 1.2.0 Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" and version "1.2.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Pwc600connectivitypackage Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" | 1.3.0 Search vendor "Hitachienergy" for product "Pwc600connectivitypackage" and version "1.3.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Sam600ioconnectivitypackage Search vendor "Hitachienergy" for product "Sam600ioconnectivitypackage" | 1.0.0 Search vendor "Hitachienergy" for product "Sam600ioconnectivitypackage" and version "1.0.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Sam600ioconnectivitypackage Search vendor "Hitachienergy" for product "Sam600ioconnectivitypackage" | 1.1.0 Search vendor "Hitachienergy" for product "Sam600ioconnectivitypackage" and version "1.1.0" | - |
Affected
| ||||||
| Hitachienergy Search vendor "Hitachienergy" | Sam600ioconnectivitypackage Search vendor "Hitachienergy" for product "Sam600ioconnectivitypackage" | 1.2.0 Search vendor "Hitachienergy" for product "Sam600ioconnectivitypackage" and version "1.2.0" | - |
Affected
| ||||||