Hitachi Energy MicroSCADA X SYS600

• CVE-2025-39205 Medium 6.5 A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack due to missing proper validation. 0.2%
• CVE-2025-39204 Medium 6.5 A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data can leak unauthorized information to the us 0.4%
• CVE-2025-39203 Medium 6.5 A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can cause a denial of service resulting in disconnection lo 0.2%
• CVE-2025-39202 High 7.3 A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corru 0.2%
• CVE-2025-39201 Medium 6.1 A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to tamper a system file, making denial of Notify service. 0.1%
• CVE-2024-3980 Critical 9.9 The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the att 0.6%
• CVE-2024-4872 Critical 9.9 A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to succ 0.5%
• CVE-2022-3353 Medium 5.9 IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products 1.1%
• CVE-2022-3388 High 8.8 Input Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 Products 0.3%
• CVE-2022-29492 Medium 5.3 A vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected conne ... 0.7%
• CVE-2022-1778 High 7.5 A vulnerability exists during the start of the affected SYS600, where an input validation flaw causes a buffer-overflow while reading a specific configuration file. Subsequently SYS600 will fail to start. The configuration file can only be accessed by ... 0.5%
• CVE-2022-29922 High 7.5 A vulnerability exists in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS ... 0.8%
• CVE-2022-2277 High 7.5 A vulnerability exists in the ICCP stack of the affected SYS600 versions due to validation flaw in the process that establishes the ICCP communication. The validation flaw will cause a denial-of-service when ICCP of SYS600 is request to forward any da ... 0.8%
• CVE-2022-29490 High 8.5 A vulnerability exists in the Workplace X WebUI in which an authenticated user is able to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. 0.7%