[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-hitachi-energys-sys600-update-still-carries-2-open-flaws":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},11912,"hitachi-energys-sys600-update-still-carries-2-open-flaws","Hitachi Energy's SYS600 Update Still Carries 2 Open Flaws","Hitachi Energy's advisory points users to version 10.8, which it also lists as affected by two of the three SYS600 flaws.","Hitachi Energy's advisory for its MicroSCADA X SYS600 control software tells customers to update to version 10.8, but the same document lists 10.8 as affected by two of the three flaws it describes.\n\nThe advisory header says 2 vulnerabilities, while the body lists three CVEs: CVE-2026-9852, CVE-2026-9853 and CVE-2026-9854. The header's CVE list also repeats CVE-2026-9853. The affected range is version 10.7 and earlier, plus 10.8 for the last two flaws. The advisory describes the product as deployed worldwide in the energy sector. Researchers at Sandia National Laboratories' CyTRICS program reported the flaws: Zachary Andrew Wagner, Steven Nicolais and Timotius Oetnung.\n\nCVE-2026-9852 is a CSV injection bug, where malicious spreadsheet formulas hidden in exported log data can modify data, insert links, exfiltrate data or, depending on configuration, run code. It scores 5 (medium) under CVSS 3.1, a standard severity scale, and 4.6 under version 4.0. Update to 10.8 fixes it.\n\nCVE-2026-9853 lets any user logged in to the server's operating system read and modify application objects without authenticating to SYS600. CVE-2026-9854 lets a user with access to the engineering tools raise their privileges to administrator on the Windows host. Both score 7.8 (high) under CVSS 3.1 and 8.5 under 4.0.\n\nFor older versions, the fix is the same: update to 10.8. For CVE-2026-9853, 10.8 itself gets only a mitigation, a configuration strategy in section 2.1.7.5 of the installation manual that the advisory says works for versions 10.3 onward. We asked Hitachi Energy for comment on the unpatched 10.8 status.\n\nFor CVE-2026-9854, the advisory lists no remediation at all for 10.8. That leaves open what a customer who has already updated is supposed to do about a flaw that hands over full control of the host.","[\"ics-security\",\"hitachi-energy\",\"scada\",\"vulnerabilities\"]","2026-10-20T12:00:00.000Z","2026-10-20T17:06:12.058Z","2026-10-20T17:06:13.286Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Drop the reader-facing aside telling people to 'check the CVE entries directly rather than the header' and just state that the advisory header says two vulnerabilities while the body lists three CVEs; fix the closing, which asks what the 'mitigation' covers for CVE-2026-9854 when the advisory lists no remediation for 10.8 on that flaw; and note that Hitachi Energy was asked for comment on the unpatched 10.8 status.","resolved","security",[32,33,34,35],"ics-security","hitachi-energy","scada","vulnerabilities",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-293-04",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7043,"2026-10-20T18:00:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1019,"2026-10-20T18:07:34.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",546,"2026-10-20T13:11:23.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",536,"2026-10-20T15:55:20.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",271,"2026-10-20T15:25:03.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",253,"2026-10-20T18:12:50.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",207,"2026-10-20T12:50:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",136,"2026-10-20T16:32:21.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",134,"2026-10-20T14:57:15.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",119,"2026-10-20T13:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",88,"2026-10-20T09:36:16.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",82,"2026-10-20T18:45:39.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":18},"Reviews","reviews",38,{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]