PT-2023-2029 · Hitachi Energy · Sdm600

Published 2023-03-28 · Updated 2023-04-04 · CVE-2022-3682

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Energy System Data Manager SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

Description A vulnerability exists in the SDM600 file permission validation, allowing an attacker to exploit the system by uploading a specially crafted message, potentially resulting in arbitrary code execution. This issue affects all SDM600 versions prior to version 1.2 FP3 HF4.

Recommendations For SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291), update to version 1.2 FP3 HF4 or later to resolve the issue. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-01741

CVE-2022-3682

Affected Products

Sdm600

References · 7

• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01741 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3682 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3682 · Vendor Advisory
• https://t.me/cibsecurity/60882 · Telegram Post
• https://t.me/cvenotify/46983 · Telegram Post
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch · Note