CVE-2023-4518

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-01 · updated 2026-06-17
Weakness: CWE-1284

Description

A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.

Affected products

Hitachienergy Relion 650 Firmware: from 2.2.4 before 2.2.4.4; from 2.2.5 before 2.2.5.6; 2.2.1, 2.2.1.6 — fixed in 2.2.4.4, 2.2.5.6
Relion 670 Series: from 2.2.0 before 2.2.2.6; from 2.2.3 before 2.2.3.7; from 2.2.4 before 2.2.4.4; from 2.2.5 before 2.2.5.6 — fixed in 2.2.2.6, 2.2.3.7, 2.2.4.4, 2.2.5.6
Hitachienergy Relion Sam600-Io Firmware: from 2.2.5 before 2.2.5.6; 2.2.1, 2.2.1.6 — fixed in 2.2.5.6

How to fix

Upgrade to a fixed version: Hitachienergy Relion 650 Firmware 2.2.4.4, 2.2.5.6; Relion 670 Series 2.2.2.6, 2.2.3.7, 2.2.4.4, 2.2.5.6; Hitachienergy Relion Sam600-Io Firmware 2.2.5.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4518 or the next vulnerability affects your stack