CVE-2022-2513 IEDs are stored in a cleartext form in Hitachi Energy's ConnPack, PCM600 versions below.

The ConnPack function is enabled by default on the PCM600, and the ConnPack backup file is created during the PCM600 export process. The following PCM600 versions are affected: PCM600V2.1.1R, PCM600V1.1.1R, PCM600V1.1.0R. PCM600V1.0.1R, PCM600V1.0.0R, PCM600V0.9.0R. PCM600V0.8.1R. PCM600V0.8.0R, PCM600V0.7.0R, PCM600V0.6.0R, PCM600V0.5.1R, PCM600V0.5.0R, PCM600V0.4.1R. It is recommended that users upgrade to a supported version listed above as soon as possible. Additionally, users should monitor for the creation of the ConnPack backup file during the export process and make sure that the ConnPack function is disabled when exporting the PCM600.

PCM600 Version History

The PCM600V2.1.1R version was the first version of the PCM600 available to replace PCM600V2.1.0R. The PCM600V2.1.1R version is not affected by CVE-2022-2513 and does create a ConnPack backup file if enabled during the export process.
PCM600V1.1.0R replaces both PCM600V2.1 and PCM600V2.1R, which means that it is not affected by CVE-2022-2513 either and will create a ConnPack backup file if enabled during the export process, but it is recommended that users upgrade to a supported version listed above as soon as possible in order to use features that have been added in later versions of the PCM600 family.

Mitigation

The ConnPack function is enabled by default on the PCM600, and the ConnPack backup file is created during the PCM600 export process. The following PCM600 versions are affected: PCM600V2.1.1R, PCM600V1.1.1R, PCM600V1.1.0R. PCM600V1.0.1R, PCM600V1.0.0R, PCM600V0.9.0R. PCM600V0.8.1R, PCM600V0.8.0R, PCM600V0.7.0R,PCM600V0.6 . 0 R     ,PC M 600 V 0 . 5 . 1 R,PC M 600 V 0 . 5 . 0 R ,PC M 600 V 0 . 4 . 1 R

Installation of PCM600 Software

When the ConnPack function is enabled, a backup file of the PCM600 software is created in the C:PCM600-ConnPack folder. The backup file, which has a .xnp extension, can be used to restore the original PCM600 software if it becomes corrupt during an export process for the PCM600.
To install the latest version of PCM600 software on a PCM600V2.1.1R or greater machine, please follow these steps:
1) Click on "File" at the top menu and then click on "Install Software".
2) Select "C:/PCM600-ConnPack/PCM_Export_XNP_FIRMWARE" from the drop-down list.
3) Click on "Next".

Timeline

Published on: 11/22/2022 11:15:00 UTC
Last modified on: 12/08/2022 15:25:00 UTC

References

• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launch
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-2513