CVE-2024-4872

The vulnerability results from insufficient input data validation in the module processing SYS600 system queries. An attacker possessing valid credentials can formulate a malicious query containing injected content that will be written into the system's persistent data (CWE-943 — improper neutralization of special elements in data query logic). Due to the network vector (AV:N) and lack of user interaction requirement (UI:N), the attack can be conducted remotely without additional hindrances after gaining access to an account.

Successful exploitation of the vulnerability allows an attacker to inject malicious code into persistent SCADA system data, which may lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) — potentially including resources beyond the direct application context.

Apply patches available from the vendor in accordance with references (Hitachi Energy publication, document ID 8DBD000160). Additionally, it is recommended to restrict access to the SYS600 system exclusively to trusted users and to monitor attempts of unauthorized access and anomalous queries.

Hitachi Energy products MicroSCADA Pro SYS600 and MicroSCADA X SYS600 — specific versions indicated in vendor references