Microscada Sys600
Monthly
Privilege escalation in Hitachi Energy MicroSCADA SYS600 allows any user with access to the engineering tools to elevate their privileges to Windows administrator on the underlying host machine, achieving full operating-system control. The flaw resides in the RBAC enforcement layer (CWE-303 - incorrect implementation of the authentication/authorization algorithm), meaning the mechanism that is supposed to constrain engineering-tool users to scoped permissions fails to enforce those boundaries against the Windows OS layer. Exploitation yields complete control of the host, directly threatening the availability, integrity, and confidentiality of the SCADA environment. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken application-layer authentication in Hitachi Energy MicroSCADA SYS600 allows any user with an operating system account on the hosting server to read and modify SYS600 application objects without possessing SYS600 credentials. Because the application relies on OS-level authentication rather than enforcing its own access controls (CWE-303), the SYS600 authentication boundary is effectively bypassed for all local OS users. In a SCADA environment managing electrical distribution infrastructure, this means OS-resident users - such as IT staff, contractors, or service accounts - can tamper with power system application objects without SCADA authorization, carrying high real-world consequences.
CSV injection (CWE-1236) in Hitachi Energy MicroSCADA SYS600 allows attackers who can write arbitrary entries to the Notify service log to embed malicious spreadsheet formulas that execute when a Windows operator exports and opens the log as a CSV file. Impact ranges from cell data manipulation and link insertion to conditional code execution on the operator's workstation, contingent on the target's spreadsheet application security configuration. No active exploitation or public proof-of-concept has been identified; Hitachi Energy has published a security advisory documenting the issue.
Privilege escalation in Hitachi Energy MicroSCADA SYS600 allows any user with access to the engineering tools to elevate their privileges to Windows administrator on the underlying host machine, achieving full operating-system control. The flaw resides in the RBAC enforcement layer (CWE-303 - incorrect implementation of the authentication/authorization algorithm), meaning the mechanism that is supposed to constrain engineering-tool users to scoped permissions fails to enforce those boundaries against the Windows OS layer. Exploitation yields complete control of the host, directly threatening the availability, integrity, and confidentiality of the SCADA environment. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken application-layer authentication in Hitachi Energy MicroSCADA SYS600 allows any user with an operating system account on the hosting server to read and modify SYS600 application objects without possessing SYS600 credentials. Because the application relies on OS-level authentication rather than enforcing its own access controls (CWE-303), the SYS600 authentication boundary is effectively bypassed for all local OS users. In a SCADA environment managing electrical distribution infrastructure, this means OS-resident users - such as IT staff, contractors, or service accounts - can tamper with power system application objects without SCADA authorization, carrying high real-world consequences.
CSV injection (CWE-1236) in Hitachi Energy MicroSCADA SYS600 allows attackers who can write arbitrary entries to the Notify service log to embed malicious spreadsheet formulas that execute when a Windows operator exports and opens the log as a CSV file. Impact ranges from cell data manipulation and link insertion to conditional code execution on the operator's workstation, contingent on the target's spreadsheet application security configuration. No active exploitation or public proof-of-concept has been identified; Hitachi Energy has published a security advisory documenting the issue.