Summary
Hitachi Energy is aware of the multiple vulnerabilities that affect the MicroSCADA Pro/X SYS600 product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability impacts.
Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
Vulnerabilities 5
-
High 8.8
The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that…
-
High 8.8
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an…
-
High 8.3
The product exposes a service that is intended for local only to all network interfaces without any authentication.
-
High 8.2
An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging suppo…
-
Medium 4.3
An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified …
Revision history
-
#4
Updated patches for versions 10.3, 10.4 and 10.5 under Recommended Actions
-
#3
Updates to affected products and recommended actions and vulnerability details
-
#2
CWE updates
-
#1
Initial version.
References
-
Cybersecurity Advisory - Multiple vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600 product
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000160&languageCode=en&Preview=true
-
ICS Advisory ICSA-24-331-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-04
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B