Full Report
The Cybersecurity and Infrastructure Security Agency (CISA) issued two crucial Industrial Control Systems (ICS) advisories, highlighting vulnerabilities that could have serious impacts on critical infrastructure. These ICS advisories, identified as ICSA-25-091-01 and ICSA-24-331-04, are designed to inform organizations about current security threats, vulnerabilities, and necessary mitigations related to ICS products and systems. Details of the Industrial Control Systems Advisories The two ICS advisories shared by CISA include vulnerabilities targeting Rockwell Automation Lifecycle Services with Veeam Backup and Replication and itachi Energy MicroSCADA Pro/X SYS600. Here is a quick breakdown of the vulnerabilities and their advisories. ICSA-25-091-01 The first advisory, ICSA-25-091-01, focuses on a severe vulnerability in Rockwell Automation's Lifecycle Services integrated with Veeam Backup and Replication. This vulnerability is related to the deserialization of untrusted data (CWE-502), a common type of issue in which attackers can manipulate software to execute malicious code remotely. A CVSS v4 score of 9.4 has been assigned to this flaw, indicating a high risk, as it is remotely exploitable with low attack complexity. Rockwell Automation’s affected products include the Industrial Data Center (IDC) with Veeam (Generations 1 – 5) and VersaVirtual Appliance (VVA) with Veeam (Series A - C). If successfully exploited, this vulnerability could allow attackers with administrative privileges to execute arbitrary code on affected systems, potentially leading to a complete system compromise. CISA urges organizations to take immediate defensive measures to mitigate the risk, including: Minimizing network exposure for all control systems and ensuring they are not directly accessible from the internet. Using secure access methods like Virtual Private Networks (VPNs) when remote access is necessary. Keeping VPNs up to date to prevent vulnerabilities from being exploited. Rockwell Automation is actively working with CISA to notify affected customers, especially those with an active Infrastructure Managed Service contract, and provide them with guidance on patching and remediation. ICSA-24-331-04 The second advisory, ICSA-24-331-04, addresses a series of vulnerabilities in Hitachi Energy's MicroSCADA Pro/X SYS600 system, an essential part of critical infrastructure in manufacturing and energy sectors. This advisory outlines multiple flaws, including issues such as improper neutralization of special elements in data query logic, path traversal vulnerabilities, and session hijacking possibilities through authentication bypass. The most severe vulnerability, CVE-2024-4872, has been assigned a CVSS v3 score of 9.9, highlighting its critical nature. This flaw allows authenticated attackers to inject malicious code into the system, potentially compromising the integrity of persistent data and allowing unauthorized access to sensitive functions. Other issues, such as improper limitations on file paths (CVE-2024-3980), could allow attackers to manipulate files essential to the system's operation, leading to further compromise. As with the Rockwell Automation advisory, CISA urges users to implement mitigations immediately to reduce the risks. Hitachi Energy has released patches for the affected versions, including a critical update to Version 10.6 for MicroSCADA Pro/X SYS600. Users are also advised to apply necessary workarounds and stay updated with security patches to protect against exploitation.
Analysis Summary
# Vulnerability: Critical Flaws in Hitachi Energy MicroSCADA Pro/X SYS600
## CVE Details
- CVE ID: CVE-2024-4872, CVE-2024-3980 (and others mentioned under ICSA-24-331-04)
- CVSS Score: 9.9 (Critical) for CVE-2024-4872
- CWE: Improper Neutralization of Special Elements used in Data Query Logic (for CVE-2024-4872, implied), Path Traversal (for CVE-2024-3980)
## Affected Systems
- Products: Hitachi Energy MicroSCADA Pro/X SYS600 system
- Versions: Versions prior to 10.6 (for MicroSCADA Pro/X SYS600)
- Configurations: Used in critical infrastructure sectors (manufacturing and energy).
## Vulnerability Description
The advisory ICSA-24-331-04 addresses a series of vulnerabilities in the Hitachi Energy MicroSCADA Pro/X SYS600 system. The most severe flaw, **CVE-2024-4872 (CVSS 9.9)**, is related to improper neutralization of special elements in data query logic. If exploited by an authenticated attacker, this flaw can lead to the injection of malicious code, potentially compromising the integrity of persistent data and enabling unauthorized access to sensitive system functions. Other listed issues include path traversal vulnerabilities (e.g., CVE-2024-3980) which allow manipulation of essential system files, and session hijacking vulnerabilities via authentication bypass.
## Exploitation
- Status: Not explicitly stated as *in the wild*, but high severity suggests urgency for patching. PoC availability is implied via CISA advisory structure.
- Complexity: Likely **Medium** or **High** as CVE-2024-4872 requires authentication, but path traversal may be simpler depending on context.
- Attack Vector: Likely **Network** or **Adjacent**, given the nature of ICS systems and authentication bypass potential.
## Impact
- Confidentiality: Potential for **High** impact due to unauthorized access to sensitive functions.
- Integrity: **High** impact, specifically allowing attackers to inject malicious code and compromise persistent data integrity.
- Availability: Potential for **Medium** to **High** impact through file manipulation (path traversal) leading to system disruption.
## Remediation
### Patches
- **Critical Update:** Hitachi Energy has released patches. Users must update MicroSCADA Pro/X SYS600 to **Version 10.6** or later.
### Workarounds
- Users are advised to apply necessary workarounds as detailed in the official CISA advisory (ICSA-24-331-04) until patching can be completed.
## Detection
- Detection methods specific to these ICS flaws were not detailed in the summary content. Generally, monitoring for unusual authenticated activity, unexpected data queries, or file system changes within the MicroSCADA environment is recommended.
## References
- Vendor Advisories: CISA ICS Advisory ICSA-24-331-04
- Relevant links - defanged:
- hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-24-331-04
- hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2024-3980