# Hitachi MicroSCADA X SYS600 five vulnerabilities enable tampering and DoS

Published: 2025-07-03 · Severity: routine · Sectors: energy, infrastructure
Canonical: https://vorant.io/reports/ead5752e-f5c4-5afe-a58f-5c880ebd84e3/hitachi-microscada-x-sys600-five-vulnerabilities-enable-tampering-and-dos

> Five vulnerabilities in Hitachi Energy MicroSCADA X SYS600 allow local and remote attackers to tamper files, leak data, or cause denial of service.

Hitachi Energy's MicroSCADA X SYS600 SCADA platform contains five distinct vulnerabilities affecting versions 10.0 through 10.6. These flaws range from incorrect default permissions and path traversal issues to improper certificate validation and data leakage through malformed queries. An authenticated local attacker could tamper with mailslot configuration files, overwrite arbitrary files, or trigger information disclosure. Remote attackers with valid credentials can craft malicious messages to cause disconnection loops, leak file content via database queries, or conduct man-in-the-middle attacks due to weak TLS certificate validation. The vulnerabilities require authentication but have low attack complexity, making them practical to exploit in environments where attacker access to the system is already possible.

No active exploitation has been reported to CISA at the time of publication. Hitachi Energy released fixed version 10.7 addressing all five flaws. Organizations running affected versions on critical energy infrastructure must prioritize patching and implement network segmentation to restrict remote access to SCADA systems. The advisory emphasizes minimizing internet exposure and requiring VPN access for legitimate remote administration.

## Mentioned in this report

- Vulnerabilities: CVE-2025-39201, CVE-2025-39202, CVE-2025-39203, CVE-2025-39204, CVE-2025-39205

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-184-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ead5752e-f5c4-5afe-a58f-5c880ebd84e3/hitachi-microscada-x-sys600-five-vulnerabilities-enable-tampering-and-dos.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup