CVE-2025-39203

mediumPriorität · verfolgen · 0EPSS 0.002 · 12. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.22% (12th) EPSS

CVSS 4.3 · medium

Is it mine?

13 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-23

A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can cause a denial of service resulting in disconnection loop.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenHitachi Energy MicroSCADA Pro/X SYS600cisa_csaf_ot
For more information see the associated Hitachi Energy PSIRT security advisory 8DBD000218 Cybersecurity Advisory - Multiple vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600 product.
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000218&languageCode=en&Preview=true
BehobenRTU500 series CMU Firmwarecisa_csaf_ot
Update to CMU Firmware version 12.7.8
BehobenMACH GWScisa_csaf_ot
Upgrade to version 3.5
MitigationHitachi Energy MicroSCADA Pro/X SYS600cisa_csaf_ot
(CVE-2025-39203) Hitachi Energy MicroSCADA X SYS600 versions from 10.5 to 10.6: Update to version 10.7
MitigationRTU500 series CMU Firmwarecisa_csaf_ot
Follow General Mitigation Factors/Workarounds.
MitigationMACH GWScisa_csaf_ot
Apply general mitigation factors

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.3–7.1

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · CISA US

v3.16.5mediumAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · cybersecurity@hitachienergy.comAusnutzbarkeit 2.8 · Auswirkung 3.6

v4.07.1highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.07.1highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cybersecurity@hitachienergy.com

v4.04.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-354USCWE-354USCWE-354US

betroffene Produkte (13)

Betroffene Produkte und Versionsbereiche.

RTU500 series CMU Firmware version 12.7.1 – 12.7.7alle Versionencisa_csaf_otUS
RTU500 series CMU Firmware version 13.4.1 – 13.4.4alle Versionencisa_csaf_otUS
RTU500 series CMU Firmware version 13.5.1 – 13.5.3alle Versionencisa_csaf_otUS
RTU500 series CMU Firmware version 13.6.1alle Versionencisa_csaf_otUS
RTU500 series CMU Firmware version 13.7.1 – 13.7.6alle Versionencisa_csaf_otUS
Hitachi Energy RTU500 series CMU Firmwarealle Versionencisa_csaf_otUS
Hitachi Energy RTU500 series CMU Firmware≤ vers:RTU500_series_CMU_Firmware/>=12.7.1|<=12.7.7cisa_csaf_otUS
Hitachi Energy RTU500 series CMU Firmware≤ vers:RTU500_series_CMU_Firmware/>=13.4.1|<=13.4.4cisa_csaf_otUS
Hitachi Energy RTU500 series CMU Firmware≤ vers:RTU500_series_CMU_Firmware/>=13.5.1|<=13.5.3cisa_csaf_otUS
Hitachi Energy RTU500 series CMU Firmware≤ vers:RTU500_series_CMU_Firmware/>=13.7.1|<=13.7.6cisa_csaf_otUS
Hitachi Energy MicroSCADA X SYS600≤ 10.5 ≤10.6enisa_euvdEU
Hitachi, Ltd. Hitachi Energy MicroSCADA X SYS60010.5 → 10.6fstec_bduRU
hitachienergy microscada x sys60010.5 → 10.7nvdUScpe:2.3:a:hitachienergy:microscada_x_sys600:*:*:*:*:*:*:*:*

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-25-184-02Hitachi Energy MicroSCADA X SYS6002025-07-03icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to tamper with the system file, overwrite files, create a denial-of-service condition, or leak file content.
ICSA-25-259-02Hitachi Energy RTU500 Series2025-09-09icsa · cisa_csaf_otUS
Hitachi Energy is aware of multiple vulnerabilities that affect the RTU500 versions that are listed below. An attacker successfully exploiting these vulnerabilities could potentially cause Denial of Service (DoS) impact on RTU500. Please refer to the Recommended Immediate Actions for information about the available mitigation/remediation strategies.
ICSA-25-289-11Hitachi Energy MACH GWS2025-09-30icsa · cisa_csaf_otUS
Hitachi Energy is aware of these vulnerabilities that affect the MACH GWS product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability impacts. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

veröffentlicht 2025-06-24geändert 2026-06-17

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan