Is CVE-2022-4304 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-4304 being exploited in the wild.

How severe is CVE-2022-4304?

High severity, with a CVSS score of 3.1, published 7 February 2023.

Which products and versions are affected?

openssl-src (crates.io) SEMVER:introduced=0,fixed=111.25.0, SEMVER:introduced=0.0.0-0,fixed=111.25.0,introduced=300.0.0,fixed=300.0.12; Hitachi Energy GMS600 1.3.0, 1.3.1.

Is there a fix for CVE-2022-4304?

Yes. openssl-src (crates.io): upgrade to 111.25.0, 300.0.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-4304 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2022-4304?

Check whether you run openssl-src (crates.io) or Hitachi Energy GMS600 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-4304: RUSTSEC-2023-0007 - Timing Oracle in RSA Decryption

CVE-2022-4304 · Severity: high · CVSS 3.1 · Published 2023-02-07

Hitachi Energy GMS600 is a monitoring system used in electrical power grids and industrial manufacturing environments. A security flaw in its underlying encryption component could allow a remote attacker to decrypt sensitive communication between the device and other systems. While the attack requires a large number of messages to succeed, it could ultimately lead to the exposure of confidential operational data.

Technologies: openssl-src (crates.io). Vendors: crates.io, Hitachi Energy.

Quick answers

Is CVE-2022-4304 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-4304 being exploited in the wild.
How severe is CVE-2022-4304?: High severity, with a CVSS score of 3.1, published 7 February 2023.
Which products and versions are affected?: openssl-src (crates.io) SEMVER:introduced=0,fixed=111.25.0, SEMVER:introduced=0.0.0-0,fixed=111.25.0,introduced=300.0.0,fixed=300.0.12; Hitachi Energy GMS600 1.3.0, 1.3.1.
Is there a fix for CVE-2022-4304?: Yes. openssl-src (crates.io): upgrade to 111.25.0, 300.0.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-4304 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2022-4304?: Check whether you run openssl-src (crates.io) or Hitachi Energy GMS600 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-src (crates.io): upgrade to 111.25.0, 300.0.12 or later
```
cargo update -p openssl-src
```

Technical details

A timing-based side-channel vulnerability (Bleichenbacher-style attack) exists in the OpenSSL RSA decryption implementation used by Hitachi Energy GMS600. The flaw, tracked as CVE-2022-4304, stems from an observable discrepancy (CWE-203) in the time taken to process RSA decryption trial messages across various padding modes (PKCS#1 v1.5, RSA-OAEP, and RSASVE). A network-based attacker who has captured a genuine TLS handshake can send a large volume of specially crafted messages to the server to observe processing times. By analyzing these discrepancies, the attacker can eventually recover the pre-master secret and decrypt the session's application data. The vulnerability is addressed in GMS600 version 1.3.2.

Affected products

Hitachi Energy GMS600 1.3.0, 1.3.1

Identifiers

CVE-2022-4304
GHSA-p52g-cm5j-mjv4
RUSTSEC-2023-0007

Timeline

2023-06-27: disclosed: Initial public release by Hitachi Energy
2026-04-28: patched: Updated fixed version information provided
2026-05-21: advisory: CISA republication of the advisory

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-01

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.