EUVD-2026-70321
GHSA-5ph9-h7vg-rh4m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector; high complexity because attacker must first inject logs and victim must open CSV in a permissive spreadsheet; scope change reflects formula execution crossing into the spreadsheet application context.
Primary rating from Vendor (Hitachi Energy).
CVSS VectorVendor: Hitachi Energy
Lifecycle Timeline
2DescriptionCVE.org
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
AnalysisAI
CSV injection (CWE-1236) in Hitachi Energy MicroSCADA SYS600 allows attackers who can write arbitrary entries to the Notify service log to embed malicious spreadsheet formulas that execute when a Windows operator exports and opens the log as a CSV file. Impact ranges from cell data manipulation and link insertion to conditional code execution on the operator's workstation, contingent on the target's spreadsheet application security configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific sequential prerequisites. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 4.6 (Medium) with vector AV:L/AC:L/AT:N/PR:N/UI:A reflects a constrained attack surface: the vulnerability is local, requires active victim interaction, and produces low-impact C/I outcomes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Hitachi Energy security advisory at https://publisher.hitachienergy.com/preview?DocumentID=8DBD000249&LanguageCode=en&DocumentPartId=&Action=Launch for patched version details, as specific fix version numbers are not confirmed in the available data and should not be inferred. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Microscada Sys600
View allPrivilege escalation in Hitachi Energy MicroSCADA SYS600 allows any user with access to the engineering tools to elevate
Broken application-layer authentication in Hitachi Energy MicroSCADA SYS600 allows any user with an operating system acc
Share
External POC / Exploit Code
Leaving vuln.today