Back to overview

CVE-2024-4872

CRITICAL
9.9
CVSS 3.1
Description
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability an attacker must have a valid credential.

Metadata

CVE ID
CVE-2024-4872
State
PUBLISHED
Assigner
Hitachi Energy
Reserved
2024-05-14 14:41 UTC
Published
2024-08-27 12:37 UTC
Last updated
2025-08-27 21:30 UTC
Primary CWE
CWE-943
CWE-943 Improper Neutralization of Special Elements in Data …
Vendor / Product
Hitachi Energy / MicroSCADA X SYS600
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (2)
VendorProductPlatformVersions
Hitachi Energy MicroSCADA Pro SYS600 — 9.4 FP2 HF1 ≤ 9.4 FP2 HF5
Hitachi Energy MicroSCADA X SYS600 — 10.0 ≤ 10.5, 10.3 vulnerability patch 2025_01, 10.4 vulnerability patch 2025_01, 10.5 vulnerability patch 2025_01
Weakness (CWE)
CWESourceDescription
CWE-943 cna CWE-943 Improper Neutralization of Special Elements in Data Query Logic
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
8.8 HIGH 3.1 cna CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview