CVE-2022-28613: Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-02 · updated 2026-06-17
Weakness: CWE-1284

Description

A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.

Affected products

ABB Rtu500 Firmware: from 12.2.1.0 before 12.2.12.0 — fixed in 12.2.12.0
Hitachi Energy RTU500 series CMU firmware: from 12.0.1.0 before 12.0.14.0; from 12.4.1.0 before 12.4.12.0; from 12.6.1.0 before 12.6.8.0; from 12.7.1.0 before 12.7.4.0; from 13.2.1.0 before 13.2.5.0 — fixed in 12.0.14.0, 12.4.12.0, 12.6.8.0, 12.7.4.0, 13.2.5.0

How to fix

Upgrade to a fixed version: ABB Rtu500 Firmware 12.2.12.0; Hitachi Energy RTU500 series CMU firmware 12.0.14.0, 12.4.12.0, 12.6.8.0, 12.7.4.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-28613 or the next vulnerability affects your stack