Lucene search

Hitachi EnergyCVELIST:CVE-2024-0400

HistoryMar 27, 2024 - 2:03 a.m.

CVE-2024-0400

2024-03-2702:03:57

CWE-94

Hitachi Energy

www.cve.org

scm software

rce vulnerability

linq query

malicious client

remote code execution

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.0%

JSON

SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An Authenticated malicious client can send a specially crafted code to skip the validation and execute arbitrary code (RCE) on the SCM Server remotely. Malicious clients can execute any command by using this RCE vulnerability.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MACH SCM",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "lessThanOrEqual": "4.38",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      }
    ]
  }
]

References

publisher.hitachienergy.com/preview?DocumentId=8DBD000189&languageCode=en&Preview=true

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2024-0400