A null pointer dereference vulnerability exists in the IEC 60870‑5‑104 protocol when operating in bidirectional mode on Hitachi Energy RTU500 series CMU firmware. A specially crafted sequence of messages sent over time can trigger the null dereference, causing a denial of service. The flaw is classified as CWE‑476 and is only exploitable when bidirectional communication (BCI) is enabled; devices configured for unidirectional operation are not impacted.

Hitachi Energy RTU500 series CMU firmware is affected when its IEC 60870‑5‑104 functionality is configured for bidirectional communication. Devices operating only in unidirectional mode are not impacted.

The CVSS score of 6.9 indicates moderate severity; the EPSS score is not available, so exploitation probability remains uncertain. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need network access to the IEC 60870‑5‑104 interface to send the malicious message sequence, making the attack vector likely remote over the control network. Successful exploitation results in a denial of service that can interrupt critical control system operations.