CVE-2024-3980

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Hitachi Energy	MicroSCADA X SYS600	>= 10.0, <= 10.5
Hitachi Energy	MicroSCADA Pro SYS600	>= 9.4 FP2 HF1, <= 9.4 FP2 HF5; 9.4 FP1
hitachienergy	microscada_sys600	>= 10.0, <= 10.5

References

https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory

Timeline

Published: Aug 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-398007.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503 CVE-2024-398017.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398027.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398037.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398049.1A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can leverage PowerPoint's acce CVE-2024-398057.8Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authenticated user to poten CVE-2024-398065.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.CVE-2024-398075.3Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring CVE-2024-398084.6Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with phy CVE-2024-398098.8The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Tech CVE-2024-398104.9Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuratio CVE-2024-398116.3Improper input validation in firmware for some Intel(R) Server M20NTP Family UEFI may allow a privileged user to potentially enable escalati