CVE-2024-3982 is a high severity flaw in Hitachi Energy MicroSCADA X SYS600, scored 8.2 by NVD. A local attacker who can enable session logging may be able to hijack an established session. The record does not state a fixed release, so read the Hitachi Energy advisory and apply the update it lists.
What's affected
The record lists MicroSCADA X SYS600 without a version range. The description says an attacker with local access to the machine could enable the session logging supported by the product and attempt to hijack an already established session. It adds two conditions that limit the risk: session logging is not enabled by default, and only users with administrator rights can enable it.
The record does not name a fixed release and this write-up did not fetch the Hitachi Energy advisory (document 8DBD000160). That advisory is the authority on affected builds and remediation.
The vector is local with low complexity and high privileges required, and the scope is changed. The KEV flag is false and the record reports no exploitation.
The NVD record is dated 2024-08-27 and carries the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, a score of 8.2 (High). Weakness class: CWE-294.
How to check if you're exposed
Check whether session logging is enabled on each SYS600 host, since the flaw depends on it. Use the product's configuration tools as described in the vendor documentation.
Then list who has administrator rights on the machine, and who has local or remote desktop access to it. Because the attack starts from local access with administrator rights, the key exposure is the set of people and tools that already hold that level of access.
Compare the installed version with the builds in the Hitachi Energy advisory.
What to do now
- Find every MicroSCADA X SYS600 installation and its version.
- Read the Hitachi Energy advisory and apply the update or mitigation it specifies.
- Keep session logging disabled unless you need it, and treat any change to that setting as an event to review.
- Limit local and remote desktop administrator access to named staff and review it regularly.
- Log administrator actions on the host so that changes to logging settings are visible.
Why it matters
The weakness is the use of authentication data that can be captured and reused, tracked as CWE-294 in the record. If session details are written to logs, anyone who can read those logs might reuse them to take over a live session.
The score is high even though the starting point is strong, because a changed scope means the impact reaches beyond the vulnerable component. The practical lesson is to keep verbose logging off in production control systems and to protect log files like credentials.
Quick check
Is session logging on by default?
No. The description says the logging level is not enabled by default and only administrators can enable it.
Which release fixes it?
The record does not say. Check the Hitachi Energy advisory.
Sources
Last reviewed: 19 October 2026.
