Hitachi Energy MicroSCADA SYS600

• CVE-2026-9854 High 8.5 A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themse 0.1%
• CVE-2026-9853 High 8.5 A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to 0.1%
• CVE-2026-9852 Medium 4.6 A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has t 0.2%
• CVE-2024-7941 Medium 4.3 An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully 0.3%
• CVE-2024-7940 High 8.3 The product exposes a service that is intended for local only to all network interfaces without any authentication. 0.6%
• CVE-2024-3982 High 8.2 An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already establishe 0.2%