CVE-2024-3982

High8.2Published on August 27, 2024

An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator rights can enable it.

CVSS score8.2 / 10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-294, CWE-294

Vendorshitachienergy

Affected products

Vendors	Product	Versions
hitachienergy	microscada x sys600	< 10.6

Vulnerabilities

Five Hitachi Energy FCP Flaws Expose Grid-Control Systems to Data, File and Session Attacks

Five Hitachi Energy FCP flaws, with CVSS 9.9, expose grid systems with GWS to data injection, file traversal, session hijack and phishing risks.

Sep 18, 202601:365 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Five Hitachi Energy FCP Flaws Expose Grid-Control Systems to Data, File and Session Attacks