Multiple Vulnerabilities Discovered in Hitachi Energy MicroSCADA X SYS600 Including CSV Injection and Privilege Escalation

Hitachi Energy is aware of multiple vulnerabilities that affect the MicroSCADA X SYS600 product. According to a CISA advisory (ICS-26-293-04) published on 2026-10-20, three distinct security flaws have been identified. The most widely reported issue, CVE-2026-9852, is a CSV injection vulnerability. Exploitation could allow an attacker to inject malicious formulas into spreadsheet data, potentially leading to data modification, link insertion, and in certain configurations, execution of malicious code on the victim's machine. This requires the attacker to create arbitrary log messages, which may be achieved through SCIL scripts, a log injection vulnerability, or the SYS600 broker, and affects Windows users who can run the Notify service and export logs.

CVE-2026-9853 involves an incorrect implementation of an authentication algorithm. This vulnerability allows any user who is authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. The CVSS 3.1 base score for this vulnerability is 7.8, classified as HIGH, with a CVSS 4.0 base score of 8.5.

CVE-2026-9854 concerns the product's RBAC (Role-Based Access Control) mechanism. Users who have access to engineering tools could potentially elevate their privileges. The advisory notes that this flaw allows users with engineering tool access to escalate their privileges, though the full description was truncated in the provided excerpt.

The affected product versions include MicroSCADA X SYS600 versions 10.7 and prior, as well as version 10.8. Hitachi Energy's headquarters are located in Switzerland, and the vulnerabilities have a worldwide deployment scope, impacting Critical Infrastructure sectors, specifically the Energy sector.

Remediation guidance directs users to update to MicroSCADA X SYS600 version 10.8. Additionally, mitigation strategies are detailed in the MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5, which is available for versions 10.3 onwards. The MicroSCADA X 10.8 Cybersecurity Deployment Guide is also referenced for further configuration guidance.