Hitachi Energy
Monthly
Privilege escalation in Hitachi Energy MicroSCADA SYS600 allows any user with access to the engineering tools to elevate their privileges to Windows administrator on the underlying host machine, achieving full operating-system control. The flaw resides in the RBAC enforcement layer (CWE-303 - incorrect implementation of the authentication/authorization algorithm), meaning the mechanism that is supposed to constrain engineering-tool users to scoped permissions fails to enforce those boundaries against the Windows OS layer. Exploitation yields complete control of the host, directly threatening the availability, integrity, and confidentiality of the SCADA environment. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken application-layer authentication in Hitachi Energy MicroSCADA SYS600 allows any user with an operating system account on the hosting server to read and modify SYS600 application objects without possessing SYS600 credentials. Because the application relies on OS-level authentication rather than enforcing its own access controls (CWE-303), the SYS600 authentication boundary is effectively bypassed for all local OS users. In a SCADA environment managing electrical distribution infrastructure, this means OS-resident users - such as IT staff, contractors, or service accounts - can tamper with power system application objects without SCADA authorization, carrying high real-world consequences.
Cleartext-transmission exposure in Hitachi Energy PROMOD V allows a network man-in-the-middle to intercept or read sensitive data because the application relies on unencrypted HTTP rather than HTTPS when communicating with a third-party Digipede grid-computing server. The flaw (CWE-1428, reliance on an insecure communications channel) carries a CVSS 4.0 base score of 7.0 and is rated high confidentiality impact with limited integrity impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Hitachi Energy RTU500 Series CMU firmware allows an unauthenticated remote attacker to crash the IEC 60870-5-104 communication process by flooding the device with General Interrogation (GI) requests at short intervals. The high-load condition triggers a NULL pointer dereference in the last entry of the enhanced message queue, causing a BCI_IEC104 fatal write error, connection interruption, and automatic restart - severing bidirectional telecontrol communication. No public exploit code has been identified at time of analysis, and exploitation requires the ability to sustain elevated request rates against a reachable IEC 104 endpoint.
CSV injection (CWE-1236) in Hitachi Energy MicroSCADA SYS600 allows attackers who can write arbitrary entries to the Notify service log to embed malicious spreadsheet formulas that execute when a Windows operator exports and opens the log as a CSV file. Impact ranges from cell data manipulation and link insertion to conditional code execution on the operator's workstation, contingent on the target's spreadsheet application security configuration. No active exploitation or public proof-of-concept has been identified; Hitachi Energy has published a security advisory documenting the issue.
NULL pointer dereference in Hitachi Energy RTU500 series CMU Firmware allows an adjacent low-privileged attacker to crash the IEC 60870-5-104 communication process by sending a specially crafted sequence of messages over time, resulting in a Denial of Service on the RTU device. Exploitation is gated behind a non-default configuration - only deployments with bidirectional communication interface (BCI) mode enabled are affected. No public exploit exists and EPSS places exploitation probability at 0.02% (7th percentile), consistent with the specialized OT/ICS context, adjacency requirement, and SSVC confirmation of no known active exploitation.
Heap-based buffer overflow in Hitachi Energy MACH HiDraw's XML parser allows a low-privileged, locally authenticated attacker to corrupt heap memory by inducing a victim to open a specially crafted XML file, with a primary impact of high availability loss (application crash) and limited confidentiality and integrity compromise. Affected versions span MACH HiDraw 9.0 through versions prior to 9.22 per EUVD-2026-31812. No public exploit identified at time of analysis, and an EPSS score of 0.01% (3rd percentile) combined with an SSVC exploitation status of 'none' confirm minimal current real-world exploitation activity.
Privilege escalation in Hitachi Energy MicroSCADA SYS600 allows any user with access to the engineering tools to elevate their privileges to Windows administrator on the underlying host machine, achieving full operating-system control. The flaw resides in the RBAC enforcement layer (CWE-303 - incorrect implementation of the authentication/authorization algorithm), meaning the mechanism that is supposed to constrain engineering-tool users to scoped permissions fails to enforce those boundaries against the Windows OS layer. Exploitation yields complete control of the host, directly threatening the availability, integrity, and confidentiality of the SCADA environment. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken application-layer authentication in Hitachi Energy MicroSCADA SYS600 allows any user with an operating system account on the hosting server to read and modify SYS600 application objects without possessing SYS600 credentials. Because the application relies on OS-level authentication rather than enforcing its own access controls (CWE-303), the SYS600 authentication boundary is effectively bypassed for all local OS users. In a SCADA environment managing electrical distribution infrastructure, this means OS-resident users - such as IT staff, contractors, or service accounts - can tamper with power system application objects without SCADA authorization, carrying high real-world consequences.
Cleartext-transmission exposure in Hitachi Energy PROMOD V allows a network man-in-the-middle to intercept or read sensitive data because the application relies on unencrypted HTTP rather than HTTPS when communicating with a third-party Digipede grid-computing server. The flaw (CWE-1428, reliance on an insecure communications channel) carries a CVSS 4.0 base score of 7.0 and is rated high confidentiality impact with limited integrity impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Hitachi Energy RTU500 Series CMU firmware allows an unauthenticated remote attacker to crash the IEC 60870-5-104 communication process by flooding the device with General Interrogation (GI) requests at short intervals. The high-load condition triggers a NULL pointer dereference in the last entry of the enhanced message queue, causing a BCI_IEC104 fatal write error, connection interruption, and automatic restart - severing bidirectional telecontrol communication. No public exploit code has been identified at time of analysis, and exploitation requires the ability to sustain elevated request rates against a reachable IEC 104 endpoint.
CSV injection (CWE-1236) in Hitachi Energy MicroSCADA SYS600 allows attackers who can write arbitrary entries to the Notify service log to embed malicious spreadsheet formulas that execute when a Windows operator exports and opens the log as a CSV file. Impact ranges from cell data manipulation and link insertion to conditional code execution on the operator's workstation, contingent on the target's spreadsheet application security configuration. No active exploitation or public proof-of-concept has been identified; Hitachi Energy has published a security advisory documenting the issue.
NULL pointer dereference in Hitachi Energy RTU500 series CMU Firmware allows an adjacent low-privileged attacker to crash the IEC 60870-5-104 communication process by sending a specially crafted sequence of messages over time, resulting in a Denial of Service on the RTU device. Exploitation is gated behind a non-default configuration - only deployments with bidirectional communication interface (BCI) mode enabled are affected. No public exploit exists and EPSS places exploitation probability at 0.02% (7th percentile), consistent with the specialized OT/ICS context, adjacency requirement, and SSVC confirmation of no known active exploitation.
Heap-based buffer overflow in Hitachi Energy MACH HiDraw's XML parser allows a low-privileged, locally authenticated attacker to corrupt heap memory by inducing a victim to open a specially crafted XML file, with a primary impact of high availability loss (application crash) and limited confidentiality and integrity compromise. Affected versions span MACH HiDraw 9.0 through versions prior to 9.22 per EUVD-2026-31812. No public exploit identified at time of analysis, and an EPSS score of 0.01% (3rd percentile) combined with an SSVC exploitation status of 'none' confirm minimal current real-world exploitation activity.