CVE-2024-2097 Code injection in MACH SCM Server
An authenticated attacker can execute arbitrary code remotely on Hitachi MACH SCM servers via malicious LINQ queries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2097?
CVE-2024-2097 is a high-severity code injection vulnerability in Hitachi Energy MACH SCM Server, published on 27 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.
Weakness: CWE-94
Which versions are affected by CVE-2024-2097?
How do I fix CVE-2024-2097?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-2097 being exploited?
There is no known exploitation of CVE-2024-2097 in the wild and no public exploit code.
Sources
Also known as GHSA-x6rr-6p9v-45m4.