CVE-2024-4872 is a critical flaw in Hitachi Energy MicroSCADA Pro/X SYS600 version 9.4, scored 9.9 by NVD. Weak query validation lets an authenticated user inject code toward persistent data. The fixed version is in Hitachi Energy's advisory, which you should read before planning work.
What's affected
The record lists MicroSCADA Pro/X SYS600 version 9.4. The description says the issue sits in the query validation of the product and that exploitation requires a valid credential.
Fixed version: the only reference in the record is Hitachi Energy's advisory document (8DBD000160). That page is a script rendered viewer, and I could not retrieve its text, so I cannot confirm a patched version number or any workaround steps. Do not guess. Open the advisory and follow its remediation section.
The vector is not reproduced here beyond the score: 9.9 puts this in the critical band. The weakness is CWE-943, improper neutralization of special elements in a data query logic.
How to check if you're exposed
SYS600 is operational technology software, so the checks are inventory and access questions, not a package manager command.
- Confirm which SYS600 version each site runs. The product's own version information and your asset register should agree.
- List every account that holds a valid SYS600 credential, including service and vendor accounts.
- Establish whether the SYS600 interface is reachable from the corporate network, a jump host or a remote access path.
If you cannot answer the third point quickly, treat that as the finding.
What to do now
- Open Hitachi Energy's advisory for CVE-2024-4872 and identify the remediation for version 9.4.
- Apply the vendor's update or mitigation in line with your change process for control systems.
- Review and trim accounts with access to the affected function. The attack needs a credential, so credential hygiene reduces exposure directly.
- Segment the SYS600 network and keep it off general purpose workstations and the internet.
- Watch audit logs for unexpected queries or changes to persistent data until the patch is in.
Why it matters
Injection flaws happen when input meant as data is interpreted as part of a query or command. Here the record says the query validation can be abused to inject code toward persistent data, which means the stored state of the system could be altered by someone who is only supposed to read or operate it.
The low privilege requirement is what makes the score so high. A 9.9 usually signals a changed scope and little effort once access exists. In a substation or utility setting, valid credentials are shared, reused and sometimes held by contractors, so the credential bar is lower than it sounds.
The record does not flag this CVE as exploited in the wild and it is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
Yes. The description says a valid credential is required, which is why account review is part of the response.
Is a fixed version confirmed here?
No. The vendor advisory could not be read, so check it directly for the patched release.
Sources
- Hitachi Energy advisory 8DBD000160 (content could not be retrieved)
- NVD record for CVE-2024-4872
Last reviewed: 19 October 2026.
