CVE-2024-3980 is a critical severity path traversal in Hitachi Energy MicroSCADA Pro SYS600, scored 9.9 by NVD. An authenticated user can influence file paths used in filesystem operations. The record does not state a fixed release, so read the Hitachi Energy advisory and apply the update it lists.
What's affected
The record lists MicroSCADA Pro SYS600 version 9.4, including the Fix Pack 1, Fix Pack 2 Hotfix 1 and Fix Pack 2 Hotfix 2 builds. The description says an authenticated user can control or influence paths or file names used in filesystem operations, and that exploitation lets the attacker access or modify system files or other files critical to the application.
The record does not name a fixed release, and this write-up did not fetch the Hitachi Energy advisory (document 8DBD000160) that carries the fix details. Treat that advisory as the authority on affected builds and remediation. Note too that the advisory covers more than one CVE for this product family.
The score of 9.9 reflects network access with low privileges and a changed scope. The KEV flag is false and the record reports no exploitation in the wild.
The NVD record is dated 2024-08-27 and carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, a score of 9.9 (Critical). Weakness class: CWE-22.
How to check if you're exposed
Check the SYS600 version and fix pack level on each MicroSCADA host through the product's own version information, then compare it with the builds the Hitachi Energy advisory lists as affected.
The record's vector needs a valid login, so also review who holds accounts on the system and where those users connect from. In operational technology networks, find out whether the SYS600 server is reachable from corporate IT networks or from remote access paths, because that decides how many people could even try.
Do not run scans against live control systems without the operator's agreement, since active probing can disturb them.
What to do now
- Identify every SYS600 installation and its version and fix pack level.
- Read the Hitachi Energy advisory and apply the update or mitigation it specifies, using your normal OT change process.
- Review accounts on the system and remove or disable those that are unused.
- Confirm network segmentation, so that the server is only reachable from the systems that need it.
- Monitor file access on the server for unexpected changes to application or system files.
Why it matters
The weakness is path traversal, CWE-22. A file operation uses a path that a user can influence, so the user can point it at files outside the intended directory. In a SCADA product, those files can include configuration and system files whose change affects how a substation or plant is monitored.
The context raises the stakes. Industrial control software often has long patch cycles and is hard to take offline, so compensating controls such as segmentation, least privilege accounts and access logging do much of the work while the vendor update is scheduled.
Quick check
Which version fixes CVE-2024-3980?
The record does not say. It lists SYS600 9.4 builds as affected and links the Hitachi Energy advisory for the fix details.
Does the attacker need to log in?
Yes. The description says an authenticated user, and the vector requires low privileges.
Sources
Last reviewed: 19 October 2026.
