Lucene search

Hitachi EnergyCVE-2024-0400

HistoryMar 27, 2024 - 3:15 a.m.

CVE-2024-0400

2024-03-2703:15:10

CWE-94

Hitachi Energy

web.nvd.nist.gov

scm software

authenticated clients

linq query

arbitrary code execution

rce vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

9.0%

JSON

SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An Authenticated malicious client can send a specially crafted code to skip the validation and execute arbitrary code (RCE) on the SCM Server remotely. Malicious clients can execute any command by using this RCE vulnerability.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MACH SCM",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "lessThanOrEqual": "4.38",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      }
    ]
  }
]

References

publisher.hitachienergy.com/preview?DocumentId=8DBD000189&languageCode=en&Preview=true

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-0400