Read the docs
TI-2022-03132 Aliases CVE-2022-3388GHSA-5xm5-wrvq-pc6h

Input Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 Products

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administrator level remote code execution irrespective of the authenticated user's role.

Why it matters now

EPSS 0.00304 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi EnergyMicroSCADA Pro SYS6009.0—No fix listedCNA
Hitachi EnergyMicroSCADA X SYS60010.0—No fix listedCNA
  • MicroSCADA Pro SYS600 VendorHitachi Energy Affected 9.0 Fixed in — No fix listed CNA
  • MicroSCADA X SYS600 VendorHitachi Energy Affected 10.0 Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:*9.0VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:*9.1VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:*9.2VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:*9.3VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:*9.4VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:*10VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:*10.1VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:*10.1.1VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:*10.2VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:*10.2.1VulnerableHitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:* Versions 9.3 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* Versions 10.1.1 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* Versions 10.2.1 Vulnerable ·Hitachi Energy
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:*10.3VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*10.3.1VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:*10.4VulnerableHitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:* Versions 10.3.1 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:* Versions 10.4 Vulnerable ·Hitachi Energy

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3388
  2. 2026-10-03 Alias added: GHSA-5xm5-wrvq-pc6h

References

Advisory 1

  • TI-2019-03985 ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
  • TI-2024-03713 Path traversal in Hitachi Energy MicroSCADA X SYS600 CVSS 3.1CRITICAL 9.9
  • TI-2024-04530 A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. CVSS 3.1CRITICAL 9.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences