Hitachi Energy PCU400
The affected versions of PCU400 rely on a version of OpenSSL that contains a buffer overflow vulnerability. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. In PCU400, this vulnerability could be exploited if a malicious TLS certificate is used to secure communication between PCU400 and PCULogger. Successful exploitation may cause a denial-of-service of the PCU400 Logger and PCUCAG server.- Note: the issue is related to logging with the PCULogger tool. Otherwise, the PCU system is not impacted.-CVE-2022-3602 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected versions of PCU400 rely on a version of OpenSSL that contains a buffer overflow vulnerability. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. In PCU400, this vulnerability could be exploited if a malicious TLS certificate is used to secure communication between PCU400 and PCULogger. Successful exploitation may cause a denial-of-service of the PCU400 Logger and PCUCAG server. - Note: the issue is related to logging with the PCULogger tool. Otherwise, the PCU system is not impacted.-CVE-2022-3786 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).