CVE-2022-29490: A vulnerability exists in the Workplace X WebUI in which an authenticated user is able to execute any MicroSCADA internal scripts irrespective of the authenticated user's role.
First published: Mon Sep 12 2022(Updated: )
Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
Credit: cybersecurity@hitachienergy.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachienergy Microscada X Sys600 | >=10.0<=10.3.1 | |
| Hitachienergy Sys600 |
Remedy
Remediated in SYS600 10.4 Update to at least SYS600 version 10.4.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-29490.
What is the severity of CVE-2022-29490?
The severity of CVE-2022-29490 is high, with a severity value of 8.8.
Which software is affected by CVE-2022-29490?
The Hitachi Energy MicroSCADA X SYS600 version 10 to v10.3.1 is affected by CVE-2022-29490.
How does the vulnerability in the Workplace X WebUI of Hitachi Energy MicroSCADA X SYS600 allow an authenticated user to execute any MicroSCADA internal scripts?
The vulnerability in the Workplace X WebUI of Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroSCADA internal scripts irrespective of the authenticated user's role.
Is Hitachi Energy Sys600 vulnerable to this vulnerability?
No, Hitachi Energy Sys600 is not vulnerable to this vulnerability.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/tags
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- vendor/hitachienergy
- canonical/hitachienergy microscada x sys600
- version/hitachienergy microscada x sys600/10.0
- version/hitachienergy microscada x sys600/10.3.1
- canonical/hitachienergy sys600