What is the CVSS score of CVE-2025-39202?

CVE-2025-39202 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of SCADA are affected by CVE-2025-39202?

CVE-2025-39202 affects MicroSCADA X SYS600 systems, allowing authenticated users with minimal privileges to access and modify files, creating risks of data breach and operational disruption.

How to fix or mitigate CVE-2025-39202?

Within 24 hours: Inventory all MicroSCADA X SYS600 deployments and identify which systems are internet-accessible or accessible to untrusted networks. Within 7 days: Implement network segmentation to restrict access to the Monitor Pro interface to authorized personnel only, and enforce multi-factor authentication for all accounts with access. Within 30 days: Establish a vendor patch management process and maintain regular contact with the vendor for patch availability; conduct privilege access reviews to minimize low-privilege user accounts with file system permissions.

SCADA CVE-2025-39202

EUVD-2025-19003 HIGH

Improper Privilege Management (CWE-269)

2025-06-24 cybersecurity@hitachienergy.com

Information Disclosure Path Traversal SCADA Siemens Microscada X Sys600

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-19003

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

CVE Published

Jun 24, 2025 - 12:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corruption.

AnalysisAI

CVE-2025-39202 is a local privilege escalation vulnerability in MicroSCADA X SYS600's Monitor Pro interface that allows authenticated users with low privileges to read and overwrite arbitrary files, leading to information disclosure and data corruption. The vulnerability affects the SYS600 product line and requires local access with valid credentials; while the CVSS score of 7.3 indicates moderate-to-high severity, real-world exploitability depends on whether this vulnerability has been added to CISA's KEV catalog or has publicly available proof-of-concept code.

Technical ContextAI

CVE-2025-39202 stems from improper access control mechanisms (CWE-269: Improper Access Control) within the Monitor Pro interface component of MicroSCADA X SYS600. The vulnerability likely results from inadequate file permission validation or missing privilege escalation checks when low-privileged authenticated users interact with file operations. The SYS600 is an industrial control/SCADA system, and the Monitor Pro interface is a supervisory component responsible for system monitoring and configuration. The root cause (CWE-269) indicates the application fails to enforce proper authorization boundaries, allowing authenticated sessions with minimal privileges to access resources intended for higher-privilege accounts. This is typical in legacy SCADA systems where interface components may not implement role-based access controls (RBAC) correctly.

RemediationAI

Apply the vendor security patch released for CVE-2025-39202 to all affected SYS600 installations. Until patching is possible: (1) Restrict local system access to trusted operators only; disable or limit Monitor Pro interface access to high-privilege accounts if feasible. (2) Implement filesystem-level access controls to protect critical SCADA configuration files and backups from modification by low-privilege service accounts. (3) Monitor file integrity using host-based intrusion detection (HIDS) tools to detect unauthorized file modifications. (4) Review user account privileges and revoke unnecessary local access for service accounts. (5) Contact MicroPower/the SYS600 vendor for advisory links and patch availability—vendor should provide specific patched versions and deployment instructions. (6) For critical systems, isolate SYS600 nodes on a segmented network to limit lateral movement if a low-privilege account is compromised.