Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2022-3353

IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products

CVSS 5.9 MediumEPSS 0.011 · 65th percentile

Published by the CVE Program (CNA: Hitachi Energy) at 21 Feb 2023, 13:50 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Hitachi Energy FOX61x TEGO1
  • unaffected tego1_r16a11
  • affected tego1_r15b08
  • affected tego1_r2a16_03
  • affected tego1_r2a16
  • affected tego1_r1e01
  • affected tego1_r1d02
  • affected tego1_r1c07
  • affected tego1_r1b02
Other versions: unaffected
Hitachi Energy GMS600
  • affected GMS600 1.3
Other versions: unaffected
Hitachi Energy ITT600 SA Explorer
  • affected ITT600 SA Explorer 1.1.0
  • affected ITT600 SA Explorer 1.1.1
  • affected ITT600 SA Explorer 1.1.2
  • affected ITT600 SA Explorer 1.5.0
  • affected ITT600 SA Explorer 1.5.1
  • affected ITT600 SA Explorer 1.6.0
  • affected ITT600 SA Explorer 1.6.0.1
  • affected ITT600 SA Explorer 1.7.0
  • affected ITT600 SA Explorer 1.7.2
  • affected ITT600 SA Explorer 1.8.0
  • affected ITT600 SA Explorer 2.0.1
  • affected ITT600 SA Explorer 2.0.2
  • and 7 more
Other versions: unaffected
Hitachi Energy MicroSCADA X SYS600
  • affected SYS600 10
  • affected SYS600 10.1
  • affected SYS600 10.1.1
  • affected SYS600 10.2
  • affected SYS600 10.2.1
  • affected SYS600 10.3
  • affected SYS600 10.3.1
  • affected SYS600 10.4
  • unaffected SYS600 10.4.1
Other versions: unaffected
Hitachi Energy MSM
  • affected MSM 2.2.3;0
Other versions: unaffected
Hitachi Energy PWC600
  • affected PWC600 1.0
  • affected PWC600 1.1
  • affected PWC600 1.2
Other versions: unaffected
Hitachi Energy REB500
  • affected REB500 7.0 to before 7.* 7.*
  • affected REB500 8.0 to before 8.* 8.*
  • unaffected REB500 8.3.3.0
Other versions: unaffected
Hitachi Energy Relion® 670
  • affected Relion 670 1.2
  • affected Relion 670 2.0
  • affected Relion 670 version 2.1
  • affected Relion 670 2.2.0
  • affected Relion 670 2.2.1
  • affected Relion 670 2.2.2
  • affected Relion 670 2.2.3
  • affected Relion 670 2.2.4
  • affected Relion 670 2.2.5
Other versions: unaffected
Hitachi Energy Relion® 650
  • affected Relion 650 1.1
  • affected Relion 650 1.3
  • affected Relion 650 2.1
  • affected Relion 650 2.2.0
  • affected Relion 650 2.2.1
  • affected Relion 650 2.2.2
  • affected Relion 650 2.2.3
  • affected Relion 650 2.2.4
  • affected Relion 650 2.2.5
Other versions: unaffected
Hitachi Energy SAM600-IO
  • affected Relion SAM600-IO 2.2.1
  • affected Relion SAM600-IO 2.2.5
Other versions: unaffected
Hitachi Energy RTU500
  • affected RTU500 12.0.1 to 12.0.14, inclusive 12.0.14
  • unaffected RTU500 12.0.15
  • affected RTU500 12.2.1 to 12.2.11, inclusive 12.2.11
  • unaffected RTU500 12.2.12
  • affected RTU500 12.4.1 to 12.4.11, inclusive 12.4.11
  • unaffected RTU500 12.4.12
  • affected RTU500 12.6.1 to 12.6.8, inclusive 12.6.8
  • unaffected RTU500 12.6.9
  • affected RTU500 12.7.1 to 12.7.4, inclusive 12.7.4
  • unaffected RTU500 12.7.5
  • affected RTU500 13.2.1 to 13.2.5, inclusive 13.2.5
  • unaffected RTU500 13.2.6
  • and 4 more
Other versions: unaffected
Hitachi Energy TXpert Hub CoreTec 4
  • affected CoreTec 4 version 2.0.*
  • affected CoreTec 4 version 2.1.*
  • affected CoreTec 4 version 2.2.*
  • affected CoreTec 4 version 2.3.*
  • affected CoreTec 4 version 2.4.*
  • affected CoreTec 4 version 3.0.*
Other versions: unaffected
Hitachi Energy TXpert Hub CoreTec 5
  • affected CoreTec 5 version 3.0.*
Other versions: unaffected
Identifiers
CVE-2022-3353
CNA
Hitachi Energy
Weakness (CWE)
CWE-404
Tags
Published
21 Feb 2023
Updated
12 Mar 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
5.9 Medium 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CNA (Hitachi Energy)
  • CISA KEV Not listed.
  • EPSS 0.011, the 65th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 21 Feb 2023. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.