A high-severity authentication bypass vulnerability in Hitachi Energy MicroSCADA SYS600 allows local users to gain unauthorized read and write access to application objects.

This vulnerability, categorized as an incorrect implementation of an authentication algorithm (CWE-303), allows an attacker with low-privileged access to the underlying operating system to bypass application-level authentication. By leveraging this flaw, an attacker can manipulate critical application objects within the SYS600 environment.

The ability for a local user to modify application objects poses a significant risk to operational integrity and security. Successful exploitation could lead to unauthorized control over industrial processes, data tampering, or service disruption, justifying the CVSS score of 8.5. Such unauthorized access undermines the security posture of the host server and potentially impacts the safety and availability of the controlled infrastructure.

Immediate Action: Review the vendor advisory provided by Hitachi Energy and apply the recommended security updates or patches as soon as they become available.

Proactive Monitoring: Monitor server access logs for suspicious activity, particularly focusing on unauthorized attempts to access or modify application files or objects by non-administrative users.

Compensating Controls: Restrict local access to the server hosting the application to only authorized personnel and implement strict OS-level permission controls to limit the reach of low-privileged accounts.

Public Exploit Available: Unknown

Given the high severity of this vulnerability and its potential impact on critical operations, administrators must prioritize the remediation process. Ensure that all systems running the affected versions of MicroSCADA SYS600 are updated immediately upon the release of a vendor fix. In the interim, enforce the principle of least privilege on the host operating system to mitigate the risk of unauthorized local access.