NULL Pointer Dereference in RTU500 IEC 60870-5-104 Communication

Executive Summary

RTU500 has a vulnerability where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This leads to a BCI_IEC104 fatal write error, causing connection interruption and restart, resulting in a denial of service for bidirectional IEC 60870-5-104 communication.

Useful 0 Not Useful 0

Detection Guidance

Monitor for BCI_IEC104 fatal write errors or connection interruptions in RTU500 devices. Check logs for NULL pointer dereference events during high-load scenarios like frequent GI requests. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service for IEC 60870-5-104 communication, disrupting bidirectional control and monitoring. It may lead to connection interruptions and restarts, affecting real-time data exchange and operational continuity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service for bidirectional IEC 60870-5-104 communication due to a NULL pointer dereference under high-load scenarios. This could disrupt critical infrastructure operations, potentially leading to data processing delays or interruptions that may impact compliance with standards like GDPR or HIPAA, which require timely data handling and availability.

Useful 0 Not Useful 0

Mitigation Strategies

Limit the frequency of GI requests to reduce load on the RTU500 device. Implement rate limiting or throttling for IEC 60870-5-104 communication. Ensure redundancy or failover mechanisms to maintain bidirectional communication during disruptions.

Useful 0 Not Useful 0