CVE-2026-9852

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Improper Neutralization of Formula Elements in a CSV File pada hitachienergy microscada x sys600. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.

Rincian

Terbit di NVD

3 September 2026

Terakhir diubah

9 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://publisher.hitachienergy.com/preview?DocumentID=8DBD000249&LanguageCode=en&DocumentPartId=&Action=Launc... advisory vendor