Hitachi Energy Relion 670, 650, SAM600-IO Series

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 8.2
• ATTENTION: Exploitable remotely
• Vendor: Hitachi Energy
• Equipment: Relion 670, 650, SAM600-IO Series
• Vulnerability: Observable Discrepancy

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to decrypt application data in transit.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Hitachi Energy reports that the following products are affected:

• Relion 670: Version 2.2.0
• Relion 670: Version 2.2.1
• Relion 650: Version 2.2.0
• Relion 650: Version 2.2.1
• Relion 670: Versions 2.2.2.0 through 2.2.2.5
• Relion 670: Versions 2.2.3.0 through 2.2.3.6
• Relion 670: Versions 2.2.4.0 through 2.2.4.3
• Relion 650: Versions 2.2.4.0 through 2.2.4.3
• Relion 670: Versions 2.2.5.0 through 2.2.5.5
• Relion 650: Versions 2.2.5.0 through 2.2.5.5
• SAM600-IO: Version 2.2.1
• SAM600-IO: Versions from 2.2.5.0 up to but not including, 2.2.5.5

3.2 VULNERABILITY OVERVIEW

3.2.1 OBSERVABLE DISCREPANCY CWE-203

A timing-based side channel exists in the OpenSSL RSA decryption implementation, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve a successful decryption, an attacker would have to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

CVE-2022-4304 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2022-4304. A base score of 8.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

Hitachi Energy reported this vulnerability to CISA.

4. MITIGATIONS

Hitachi Energy has identified the following specific workarounds and mitigations users can apply to reduce risk:

• Relion 670 series version 2.2.0: Apply general mitigation factors.
• Relion 670 series version 2.2.1: Apply general mitigation factors.
• Relion 650 series version 2.2.0: Apply general mitigation factors.
• Relion 650 series version 2.2.1: Apply general mitigation factors.
• Relion 670 series version 2.2.2 through 2.2.2.5: Update to version 2.2.2.6 or latest.
• Relion 670 series version 2.2.3 through 2.2.3.6: Update to version 2.2.3.7 or latest.
• Relion 670 series version 2.2.4 through 2.2.4.3: Update to version 2.2.4.4 or latest.
• Relion 650 series version 2.2.4 through 2.2.4.3: Update to version 2.2.4.4 or latest.
• Relion 670 series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.
• Relion 650 series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.
• SAM600-IO series version 2.2.1: Apply general mitigation factors.
• SAM600-IO series version 2.2.5 through 2.2.5.5: Update to version 2.2.5.6 or latest.

For more information, see the associated Hitachi Energy PSIRT Security Advisory 8DBD000157.

Hitachi Energy recommends the following general mitigation factors and security practices:

• Configure firewalls to protect process control networks from attacks originating from outside the network.
• Physically protect process control systems from direct access by unauthorized personnel.
• Avoid directly connecting control systems to the internet.
• Separate process control networks from other networks via a firewall system with minimal exposed ports.
• Users should not use process control systems for internet surfing, instant messaging, or email.
• Portable computers and removable storage media should be carefully scanned for viruses before connecting to a control system.
• Enforce proper password policies and processes.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

5. UPDATE HISTORY

• June 10, 2025: Initial Republication of Hitachi Energy’s 8DBD000157.