Hitachi Energy Microscada Sys600 vulnerabilities

6 vulnerabilities

Known vulnerabilities in Hitachi Energy Microscada Sys600, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2024-7941hitachi energymicroscada sys600+1
EPSS score
0.34%
An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.9.8CVE-2024-7940hitachi energymicroscada sys600+1
EPSS score
0.58%
The product exposes a service that is intended for local only to all network interfaces without any authentication.8.2CVE-2024-3982hitachi energymicroscada sys600+1
EPSS score
0.22%
An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator rights can enable it.8.5CVE-2026-9854hitachi energymicroscada sys600+1
EPSS score
0.14%
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.8.5CVE-2026-9853hitachi energymicroscada sys600+1
EPSS score
0.14%
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify application objects.7.8CVE-2026-9852hitachi energymicroscada sys600+1
EPSS score
0.21%
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.