CVE-2024-3982 Auth bypass in MicroSCADA SYS600

High 8.2 Published 27 Aug 2024 Updated 27 Aug 2024

Local attackers with admin rights can enable session logging to hijack established sessions in MicroSCADA X SYS600.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-3982?

CVE-2024-3982 is a high-severity authentication bypass vulnerability in Hitachi Energy MicroSCADA SYS600, published on 27 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator rights can enable it.

Weakness: CWE-294

Which versions are affected by CVE-2024-3982?

It affects 1 product.

Products include Hitachienergy Microscada X Sys600.

How do I fix CVE-2024-3982?

No fix has been published for CVE-2024-3982 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-3982 being exploited?

There is no known exploitation of CVE-2024-3982 in the wild and no public exploit code.

Sources

Also known as GHSA-73hq-7p8j-4vp8.