Most recent entries from all

bdu:2022-06255

EUVD-2026-242977

fkie_cve-2022-2277

Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a denial-of-service when ICCP of SYS600 is request to forward any data item updates with timestamps too distant in the future to any remote ICCP system. By default, ICCP is not configured and not enabled. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10.2 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*

GHSA-m8wx-w8wv-8q47

gsd-2022-2277

ICSA-22-272-01 — Hitachi Energy MicroSCADA Pro X SYS600

A vulnerability exists during the start of SYS600, where an input validation flaw causes a buffer-overflow while reading a specific configuration file. Subsequently, SYS600 could fail to start. Administrator access is required for accessing the configuration file.CVE-2022-1778 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A vulnerability exists in the ICCP stack due to a validation flaw in the process establishing the ICCP communication. The validation flaw could cause a denial-of-service condition when ICCP of SYS600 is requested to forward any data item updates with timestamps too distant in the future to any remote ICCP system. By default, ICCP is not configured and not enabled.CVE-2022-2277 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A vulnerability exists in the Workplace X WebUI, in which an authenticated user could execute any MicroSCADA internal scripts irrespective of the authenticated user's role.CVE-2022-29490 has been assigned to this vulnerability. A CVSS v3 base score of 8.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). A vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left…