EUVD-2025-19003CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corruption.
Analysis
CVE-2025-39202 is a local privilege escalation vulnerability in MicroSCADA X SYS600's Monitor Pro interface that allows authenticated users with low privileges to read and overwrite arbitrary files, leading to information disclosure and data corruption. The vulnerability affects the SYS600 product line and requires local access with valid credentials; while the CVSS score of 7.3 indicates moderate-to-high severity, real-world exploitability depends on whether this vulnerability has been added to CISA's KEV catalog or has publicly available proof-of-concept code.
Technical Context
CVE-2025-39202 stems from improper access control mechanisms (CWE-269: Improper Access Control) within the Monitor Pro interface component of MicroSCADA X SYS600. The vulnerability likely results from inadequate file permission validation or missing privilege escalation checks when low-privileged authenticated users interact with file operations. The SYS600 is an industrial control/SCADA system, and the Monitor Pro interface is a supervisory component responsible for system monitoring and configuration. The root cause (CWE-269) indicates the application fails to enforce proper authorization boundaries, allowing authenticated sessions with minimal privileges to access resources intended for higher-privilege accounts. This is typical in legacy SCADA systems where interface components may not implement role-based access controls (RBAC) correctly.
Affected Products
MicroSCADA X SYS600 product line, specifically the Monitor Pro interface component. Without explicit version strings provided, the vulnerability likely affects multiple SYS600 firmware versions until a patch is released. CPE string would likely be: cpe:2.3:a:micropower:microscada_x:*:*:*:*:*:*:*:* or cpe:2.3:a:micropower:microscada_x_sys600:*:*:*:*:*:*:*:* (vendor confirmation required). Affected configurations include any SYS600 deployment where Monitor Pro is enabled and local system access is available to authenticated users.
Remediation
Apply the vendor security patch released for CVE-2025-39202 to all affected SYS600 installations. Until patching is possible: (1) Restrict local system access to trusted operators only; disable or limit Monitor Pro interface access to high-privilege accounts if feasible. (2) Implement filesystem-level access controls to protect critical SCADA configuration files and backups from modification by low-privilege service accounts. (3) Monitor file integrity using host-based intrusion detection (HIDS) tools to detect unauthorized file modifications. (4) Review user account privileges and revoke unnecessary local access for service accounts. (5) Contact MicroPower/the SYS600 vendor for advisory links and patch availability—vendor should provide specific patched versions and deployment instructions. (6) For critical systems, isolate SYS600 nodes on a segmented network to limit lateral movement if a low-privilege account is compromised.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today