CVE Feed

    Dashboard / CVE / CVE-2022-2277

    CVE-2022-2277

    Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a denial-of-service when ICCP of SYS600 is request to forward any data item updates with timestamps too distant in the future to any remote ICCP system. By default, ICCP is not configured and not enabled. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10.2 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*

    Published:Sep 14, 2022
    Last Modified:Jun 4, 2025
    EPS:Sep 14, 2022
    EPSS Score:0.00107
    CVSS Score:7.5

    Affected Products

    Vendor
    Hitachienergy
    Product
    Microscada X Sys600
    Vendor
    Hitachienergy
    Product
    Sys600

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-9854 (CVSS 8.5) — A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could eleva…
    CVE-2026-9853 (CVSS 8.5) — A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hos…
    CVE-2026-9852 (CVSS 4.6) — A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spre…
    CVE-2025-39205 (CVSS 7.1) — A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS …
    CVE-2025-39204 (CVSS 8.5) — A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web…
    CVE-2025-39203 (CVSS 7.1) — A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message con…
    CVE-2025-39202 (CVSS 8.3) — A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated us…
    CVE-2025-39201 (CVSS 6.9) — A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated a…
    CVE-2024-7941 (CVSS 4.3) — An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the s…
    CVE-2024-7940 (CVSS 8.3) — The product exposes a service that is intended for local only to all network interfaces without any authentica…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High