CVE-2022-3388 : An input validation vulnerability exists in the Monitor Pro interface of MicroSC

An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administrator level remote code execution irrespective of the authenticated user's role.

Published 2022-11-21 19:15:13

Updated 2023-10-19 05:15:58

Source Hitachi Energy

View at NVD, CVE.org

Vulnerability category: Input validationExecute code

Products affected by CVE-2022-3388

Hitachienergy » Microscada X Sys600 » Version: 10.1
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada X Sys600 » Version: 10.1.1
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada X Sys600 » Version: 10.2
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada X Sys600 » Version: 10.2.1
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada X Sys600 » Version: 10.3
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada X Sys600 » Version: 10.3.1
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada X Sys600 » Version: 10.4
cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada X Sys600 » Version: 10
cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada Pro Sys600 » Version: 9.1
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada Pro Sys600 » Version: 9.2
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada Pro Sys600 » Version: 9.3
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada Pro Sys600 » Version: 9.4
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:*
Matching versions
Hitachienergy » Microscada Pro Sys600 » Version: 9.0
cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-3388

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 33 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-3388

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	2.0	6.0	Hitachi Energy
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-3388

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Assigned by:
- cybersecurity@hitachienergy.com (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2022-3388

https://search.abb.com/library/Download.aspx?DocumentID=8DBD000123&LanguageCode=en&DocumentPartId=&Action=Launch&elqaid=4293&elqat=1

Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-3388

Products affected by CVE-2022-3388

Exploit prediction scoring system (EPSS) score for CVE-2022-3388

CVSS scores for CVE-2022-3388

CWE ids for CVE-2022-3388

References for CVE-2022-3388