4.6
Moyenne
CVE-2026-9852 A CSV injection vulnerability exists in SYS600
Description
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MicroSCADA SYS600 10.0 | 10.0 → 10.7 | Pas de correctif indiqué |
Autres CVE de MicroSCADA SYS600
Les 6 CVE de MicroSCADA SYS600 →
CVE-2026-9854
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their…
8.5
Élevée
CVE-2026-9853
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the…
8.5
Élevée
CVE-2024-7941
An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified…
4.3
Moyenne
CVE-2024-7940
The product exposes a service that is intended for local only to
all network interfaces without any authentication
8.3
Élevée