Authenticated Remote Code Execution Vulnerability Affects SCM Server

CVE-2024-0400

Summary

SCM Software, developed by Hitachi Energy, is designed for both client and server applications. This vulnerability allows an authenticated system manager client to execute LINQ queries on the SCM server for customized filtering. However, a malicious authenticated client can exploit this functionality by sending specially crafted input that bypasses validation checks, enabling the remote execution of arbitrary code on the SCM server. This instance of remote code execution (RCE) poses a significant risk, as it grants attackers the ability to execute any command on the server, potentially compromising the entire system.

References