Hitachi reports critical flaws in its MicroSCADA X SYS600, urges patching
Take action: Usual practices for ICS systems - isolate into separate network always apply. But do review the vulnerabilities and plan to patch - especially since even the vendor urges patching.
Learn More
Hitachi Energy has reported multiple high to critical severity vulnerabilities in its MicroSCADA X SYS600 product, which is widely used for monitoring and controlling utility power systems.
Reported vulnerabilities:
- CVE-2024-4872 (CVSS score 9.9): This critical vulnerability involves SQL injection due to improper validation of user queries, allowing attackers to execute unauthorized commands.
- CVE-2024-3980 (CVSS score 9.9): An argument injection flaw that could let attackers access or modify critical system files, compromising system integrity.
- CVE-2024-3982 (CVSS score 8.2): An authentication bypass vulnerability enabling session hijacking. Exploitation requires local access and administrative rights to enable session logging, which is disabled by default.
- CVE-2024-7940 (CVSS score 8.3): Missing authentication for a critical function, exposing services meant for local access to all network services without any security barriers.
- CVE-2024-7941 (CVSS score 4.3): A less severe vulnerability that can redirect users to malicious websites, potentially leading to phishing attacks.
These vulnerabilities pose a significant risk to power companies that rely on MicroSCADA for real-time monitoring and control of substations. Attackers could disrupt power supply, similar to past incidents like those involving Russia’s Sandworm group targeting Ukrainian power systems.
