Hitachi Energy Gateway Station
A vulnerability exists in the ICCP stack due to validation flaw in the process establishing the ICCP communication. The validation flaw will cause a denial-of-service condition when ICCP of SYS600 is requested to forward any data item updates with timestamps too far in the future. By default, ICCP is not configured and not enabled. CVE-2022-2277 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A vulnerability exists in the handling of malformed IEC 104 TCP packets. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped; however, the TCP connection is left open. This may cause a denial-of-service condition if the affected connection is left open. CVE-2022-29492 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). A vulnerability exists in the handling of specially crafted IEC 61850 packets with a valid data item but incorrect data type in the IEC 61850 OPC Server. The vulnerability may cause a denial-of-service condition on the IEC 61850 OPC Server component of the GWS product. CVE-2022-29922 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A vulnerability exists during the start of GWS in which an input validation flaw, causing a buffer overflow while reading a specific configuration file. Subsequently, GWS will fail to start. The configuration file can only be accessed by users with administrator access. CVE-2022-1778 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).