Lucene search

Hitachi EnergyCVELIST:CVE-2024-3980

HistoryAug 27, 2024 - 12:42 p.m.

CVE-2024-3980

2024-08-2712:42:41

CWE-22

Hitachi Energy

www.cve.org

user input control

filesystem operations

unauthorized access

critical files

cve-2024-3980

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

19.7%

JSON

The product allows user input to control or influence paths or file
names that are used in filesystem operations, allowing the attacker to access or modify system files or other files that are
critical to the application.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MicroSCADA SYS600",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "lessThanOrEqual": "10.5",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      }
    ]
  }
]

References

publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

19.7%

JSON

Related for CVELIST:CVE-2024-3980