Executive brief
Hitachi Energy GMS600 is a monitoring system used in electrical power grids and industrial manufacturing environments. A security flaw in its underlying encryption component could allow a remote attacker to decrypt sensitive communication between the device and other systems. While the attack requires a large number of messages to succeed, it could ultimately lead to the exposure of confidential operational data.
Technical details
A timing-based side-channel vulnerability (Bleichenbacher-style attack) exists in the OpenSSL RSA decryption implementation used by Hitachi Energy GMS600. The flaw, tracked as CVE-2022-4304, stems from an observable discrepancy (CWE-203) in the time taken to process RSA decryption trial messages across various padding modes (PKCS#1 v1.5, RSA-OAEP, and RSASVE). A network-based attacker who has captured a genuine TLS handshake can send a large volume of specially crafted messages to the server to observe processing times. By analyzing these discrepancies, the attacker can eventually recover the pre-master secret and decrypt the session's application data. The vulnerability is addressed in GMS600 version 1.3.2.
Affected products
- Hitachi Energy GMS600 1.3.0, 1.3.1
Timeline
- 2023-06-27: disclosed: Initial public release by Hitachi Energy
- 2026-04-28: patched: Updated fixed version information provided
- 2026-05-21: advisory: CISA republication of the advisory