CVE Feed

    Dashboard / CVE / CVE-2025-39205

    CVE-2025-39205

    A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack due to missing proper validation.

    Published:Jun 24, 2025
    Last Modified:Jan 30, 2026
    EPS:Jun 24, 2025
    EPSS Score:0.00024
    CVSS Score:6.5

    Affected Products

    Vendor
    Hitachienergy
    Product
    Microscada X Sys600

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-9854 (CVSS 8.5) — A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could eleva…
    CVE-2026-9853 (CVSS 8.5) — A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hos…
    CVE-2026-9852 (CVSS 4.6) — A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spre…
    CVE-2025-39204 (CVSS 8.5) — A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web…
    CVE-2025-39203 (CVSS 7.1) — A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message con…
    CVE-2025-39202 (CVSS 8.3) — A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated us…
    CVE-2025-39201 (CVSS 6.9) — A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated a…
    CVE-2024-7941 (CVSS 4.3) — An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the s…
    CVE-2024-7940 (CVSS 8.3) — The product exposes a service that is intended for local only to all network interfaces without any authentica…
    CVE-2024-3982 (CVSS 8.2) — An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logg…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High