CVE-2024-3980

Critical9.9Published on August 27, 2024

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application.

CVSS score9.9 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-22, CWE-22

Vendorshitachienergy

Affected products

Vendors	Product	Versions
hitachienergy	microscada pro sys600	9.4
hitachienergy	microscada x sys600	< 10.6

Vulnerabilities

Five Hitachi Energy FCP Flaws Expose Grid-Control Systems to Data, File and Session Attacks

Five Hitachi Energy FCP flaws, with CVSS 9.9, expose grid systems with GWS to data injection, file traversal, session hijack and phishing risks.

Sep 18, 202601:365 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Five Hitachi Energy FCP Flaws Expose Grid-Control Systems to Data, File and Session Attacks