Description
An authenticated malicious client can send a special LINQ query
to execute arbitrary code remotely (RCE) on the SCM server
from List control, and execute the arbitrary code on the same
system where SCMArchivedEventViewerTool is installed in the
case of SCM Tools.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hitachi Energy | MACH SCM Server | 4.0 – ≤ 4.38.3 | — |
| Hitachi Energy | MACH SCM Tools | 1.0 – ≤ 1.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | mysql +6 | 8.0.36-1.el9_3 | ALSA-2024:1141 |
Advisories 2
- ALSA-2024:1141 Moderate: mysql security update AlmaLinux Security Advisories · Oct 29, 2026
- ICSA-24-116-02 Hitachi Energy MACH SCM (Update A) CISA ICS & IT advisories · Sep 30, 2025