Description

RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-03T13:04:35.693Z",
  "pubdate": "2026-09-03T13:04:35.693Z",
  "executiveSummary": "The RTU500 product contains a vulnerability characterized by a NULL pointer dereference within its communication stack, specifically affecting the handling of the IEC 60870-5-104 protocol.\nThe vulnerability is triggered during high-load conditions, such as the rapid transmission of General Interrogation (GI) requests.\nSuccessful exploitation leads to a BCI_IEC104 fatal write error, causing the immediate termination of the communication process and subsequent restart of the device.\nThis behavior results in a Denial of Service (DoS), effectively disrupting bidirectional communication for the IEC 60870-5-104 protocol.\nThe vulnerability is reachable over the network and requires no specific authentication, as it leverages standard protocol operations performed at high frequency.\nThe risk implication is significant for industrial control environments where continuous telemetry and command execution are mission-critical, as an attacker can induce instability and force repeated device reboots through controlled traffic flooding.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of the enhanced message queue within the RTU500 internal communication firmware.\nUnder normal operational parameters, the message queue processes IEC 60870-5-104 packets sequentially; however, when high-frequency GI requests are introduced, a race condition or an exhaustion of memory resources occurs within the queue management logic.\nSpecifically, the last entry of the enhanced message queue fails to validate a pointer during high-load processing, leading to a NULL pointer dereference when the system attempts to perform a write operation to that memory address.\nThis invalid memory access triggers a BCI_IEC104 fatal write error, which forces the communication stack to crash as an exception handling mechanism, subsequently triggering a system reboot to recover the process.\nThe attack flow involves an attacker sending a sustained burst of GI requests at short intervals, exceeding the threshold the internal queue handler expects to process before the next insertion. By inducing a state where the queue is saturated, the attacker forces the system to attempt a reference to an uninitialized or NULL memory segment at the tail end of the queue data structure.\nThe vulnerability is inherent to the IEC 60870-5-104 communication subsystem and does not require elevated privileges or pre-existing authentication to trigger, provided the attacker has network access to the RTU500's communication interface.\nPost-exploitation, the device enters a reboot cycle, causing a complete loss of visibility and control for the SCADA or HMI systems monitoring or managing the RTU500.\nThis flaw demonstrates a lack of robust input validation and boundary checking during intensive queue operations, making the device susceptible to resource exhaustion-driven crashes."
}