Skip to content
OpenAdvisories
High ICSA-22-272-01 5 CVEs

Hitachi Energy MicroSCADA Pro X SYS600

Published Sep 29, 2022 · Updated Sep 29, 2022

Vendor: Hitachi Energy Product: SYS600

Summary

Successful exploitation of this vulnerability could cause SYS600 fail to start or an unauthorized actor to run scripts, and could cause a denial-of-service condition.

Vulnerabilities 5

  • High 8.5
    CVE-2022-29490

    A vulnerability exists in the Workplace X WebUI in which an authenticated user is able to execute any MicroSCADA internal scripts irrespective of the authenticated user's role.

    Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. This issue affects: Hitachi E…

    Hitachi Energy MicroSCADA X SYS600 ICS / OT
  • High 7.5
    CVE-2022-1778

    A vulnerability exists during the start of the affected SYS600, where an input validation flaw causes a buffer-overflow while reading a specific configuration file. Subsequently SYS600 will fail to start. The configuration file can only be accessed by ...

    Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes a failure to start the SYS600. The configuration file can only be accessed by an administrator acces…

    Hitachi Energy MicroSCADA X SYS600 ICS / OT
  • High 7.5
    CVE-2022-2277

    A vulnerability exists in the ICCP stack of the affected SYS600 versions due to validation flaw in the process that establishes the ICCP communication. The validation flaw will cause a denial-of-service when ICCP of SYS600 is request to forward any da ...

    Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a denial-of-service when ICCP of SYS600 is request to forward any data item updates with timestamps too di…

    Hitachi Energy MicroSCADA X SYS600 ICS / OT
  • High 7.5
    CVE-2022-29922

    A vulnerability exists in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS ...

    Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. The vulnerability…

    Hitachi Energy MicroSCADA X SYS600 MicroSCADA Pro SYS600 ICS / OT
  • Medium 5.3
    CVE-2022-29492

    A vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected conne ...

    Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connect…

    Hitachi Energy MicroSCADA X SYS600 MicroSCADA Pro SYS600 ICS / OT

Revision history

  1. #1

    Publication Date

References