Multiple Vulnerabilities in Hitachi Energy MicroSCADA X SYS600 Threaten Critical Infrastructure
CISA alerts to critical flaws in Hitachi Energy's MicroSCADA X SYS600 product, potentially enabling code execution and unauthorized access in energy sector systems.
CISA has issued a significant advisory detailing multiple vulnerabilities affecting Hitachi Energy's MicroSCADA X SYS600 product, a critical component used in energy sector operations. The vulnerabilities, present in versions prior to 10.8, could allow attackers to execute code, gain unauthorized access, and manipulate sensitive data within industrial control systems.
One of the primary concerns is CVE-2026-9852, a CSV injection vulnerability. This flaw allows an attacker to inject malicious formulas into log messages, which, when exported, could lead to data exfiltration, modification of spreadsheet data, or even arbitrary code execution on the user's machine, depending on the system's configuration. Exploiting this requires an attacker to have a method for creating arbitrary log messages, which can be achieved through SCIL scripts or other log injection vulnerabilities within the SYS600 broker.
Another critical vulnerability, CVE-2026-9853, bypasses the standard authentication mechanisms of the SYS600 system. It permits any user with operating system-level access to the server hosting the application to read and modify application objects without proper SYS600 authentication. This significantly lowers the barrier to entry for attackers who gain initial OS access, allowing them to tamper with critical operational data and configurations.
Furthermore, CVE-2026-9854 presents a privilege escalation risk. This vulnerability within the SYS600 Role-Based Access Control (RBAC) mechanism allows users with access to engineering tools to elevate their privileges to administrator level on the underlying Windows host. This grants them complete control over the host machine, enabling further lateral movement and deeper system compromise.
Hitachi Energy has released version 10.8 of MicroSCADA X SYS600 as a vendor fix for these issues. Additionally, a mitigation strategy is available for versions 10.3 onwards, detailed in the product's installation and administration manuals. Users are strongly advised to update to the latest version and implement the recommended mitigation steps to protect their systems.
The potential impact of these vulnerabilities is severe, given the widespread deployment of MicroSCADA X SYS600 in critical energy infrastructure worldwide. Successful exploitation could lead to disruptions in power generation, transmission, and distribution, with cascading effects on other essential services.
The advisory highlights the ongoing threat landscape for industrial control systems, where vulnerabilities in specialized software can have far-reaching consequences. The timely disclosure and patching of these flaws are crucial for maintaining the security and reliability of global energy grids.
Sandia National Laboratories researchers Zachary Andrew Wagner, Steven Nicolais, and Timotius Oetnung are credited with reporting these vulnerabilities to CISA, underscoring the importance of coordinated vulnerability disclosure and research in securing operational technology environments.