Two medium-severity libexpat flaws in Hitachi Energy REB500 versions 8.3.3.1 and prior enable authenticated users to crash or exhaust memory on energy-sector protection devices via crafted IEC 61850 messages. REB500's IEC 61850 functionality uses a vulnerable libexpat library. CVE-2024-8176 is a stack overflow from uncontrolled recursion that may cause memory corruption; CVE-2025-59375 allows small documents to trigger large memory allocations. Both require authentication and local access, and both are fixed in version 8.3.4.0.
CVE-2024-8176
2 posts
Hitachi Energy REB500 (CVE-2024-8176, CVE-2025-59375) Hitachi Energy ITT600 Explorer (CVE-2024-8176, CVE-2025-59375) Hitachi Energy ITT600 Explorer contains two high-severity vulnerabilities (CVE-2024-8176, CVE-2025-59375) within its libexpat library implementation. These flaws, triggered via crafted IEC61850 messages or documents during server simulation, can lead to uncontrolled recursion and resource exhaustion, resulting in Denial of Service (DoS) or memory corruption.