EUVD-2026-70319
GHSA-3968-4qvg-96wm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges (engineering-tool account) is sufficient; no user interaction needed; full CIA impact on the Windows host.
Primary rating from Vendor (Hitachi Energy).
CVSS VectorVendor: Hitachi Energy
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
AnalysisAI
Privilege escalation in Hitachi Energy MicroSCADA SYS600 allows any user with access to the engineering tools to elevate their privileges to Windows administrator on the underlying host machine, achieving full operating-system control. The flaw resides in the RBAC enforcement layer (CWE-303 - incorrect implementation of the authentication/authorization algorithm), meaning the mechanism that is supposed to constrain engineering-tool users to scoped permissions fails to enforce those boundaries against the Windows OS layer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the SYS600 host and a valid account with access to the MicroSCADA SYS600 engineering tools - this is PR:L (low-privilege authenticated), not unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms local exploitation with low privileges and no special attack requirements, yielding high impact across all three CIA dimensions on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Hitachi Energy advisory at https://publisher.hitachienergy.com/preview?DocumentID=8DBD000249&LanguageCode=en&DocumentPartId=&Action=Launch for the official patched version and upgrade instructions, as no specific fix version is extractable from available metadata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Hitachi Energy MicroSCADA SYS600 deployments, identify current patch levels, and restrict network/physical access to engineering tool interfaces. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Microscada Sys600
View allBroken application-layer authentication in Hitachi Energy MicroSCADA SYS600 allows any user with an operating system acc
CSV injection (CWE-1236) in Hitachi Energy MicroSCADA SYS600 allows attackers who can write arbitrary entries to the Not
Share
External POC / Exploit Code
Leaving vuln.today