« Volver al listado

CVE-2022-3388

Estado: ModificadaAlta (7.8)—

An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administrator level remote code execution irrespective of the authenticated user's role.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Hitachienergy — Microscada PRO Sys600Hitachienergy — Microscada X Sys600

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-3388",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@hitachienergy.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@hitachienergy.com",
      "affectedData": [
        {
          "vendor": "Hitachi Energy",
          "product": "MicroSCADA Pro SYS600",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Hitachi Energy",
          "product": "MicroSCADA X SYS600",
          "versions": [
            {
              "status": "affected",
              "version": "10.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2022-11-21T19:15:13.353",
  "references": [
    {
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000123&LanguageCode=en&DocumentPartId=&Action=Launch&elqaid=4293&elqat=1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@hitachienergy.com"
    },
    {
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000123&LanguageCode=en&DocumentPartId=&Action=Launch&elqaid=4293&elqat=1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@hitachienergy.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA\nPro and MicroSCADA X SYS600. An authenticated user can launch an administrator level remote code execution irrespective of the authenticated user's role."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de validación de entrada en la interfaz Monitor Pro de MicroSCADA Pro y MicroSCADA X SYS600. Un usuario autenticado puede iniciar una ejecución remota de código a nivel de administrador, independientemente de su rol."
    }
  ],
  "lastModified": "2026-06-17T04:59:26.243",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04AC7D20-659E-4844-A5A1-5B995FDB1B44"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A63E12C-E39C-420F-AEA2-377A60E03A28"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCD469ED-619F-4075-923A-8D6E15245831"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0577CAD7-1C5C-40D6-B20B-56F532642583"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECDCF4E1-FCCC-4984-AE92-3C188B469E63"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "606A7937-B800-4862-9B38-91E10BD54184"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "572594C5-7BDF-4555-954E-59AC83373E0B"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9F9C6EE-D049-42E7-8843-9C732DCB1E49"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D603FC1-851F-49DD-931C-E74F142F6281"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8617D0B8-0516-4CA2-9CFA-B9B65D8E125F"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC293ABD-343C-4DE1-BE14-E3033DE094AE"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "571AF4DB-6A32-49CF-B8E9-8224A084BE35"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E8462B2-9E02-414C-96DA-98C812089F56"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cybersecurity@hitachienergy.com"
}