title: Input Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 Products
description:
An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA
Pro and MicroSCADA X SYS600. An authenticated user can launch an administrator level remote code execution irrespective of the authenticated user's role.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: MicroSCADA Pro SYS600
vendor: Hitachi Energy
versions:
status: affected, version: 9.0
}
{
defaultStatus: unaffected
product: MicroSCADA X SYS600
vendor: Hitachi Energy
versions:
status: affected, version: 10.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: For SYS600 9.x: update to at SYS600 version SYS600 9.4 FP2 Hotfix 5 when it is released or upgrade to at least SYS600 version 10.4.1.
A requirement to install SYS600 9.4 FP2 Hotfix 5 is to have at least
the SYS600 9.4 FP2 Hotfix 4 installed.
CPE:
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:*
workarounds:
Recommended security practices and firewall configurations can help protect a process control network from
attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and
are separated from other networks by means of a firewall system that has a minimal number of ports exposed,
and others that have to be evaluated case by case. Process control systems should not be used for Internet
surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed.
We recommend following the cybersecurity deployment guideline as follows: 1MRK511518 MicroSCADA X
Cyber Security Deployment Guideline.