SecBoard
Zurück zur CVE-Übersicht

CVE-2026-9852

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 7.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

Beschreibung

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects potential CSV injection attempts by monitoring for unusual log messages or script executions that could lead to malicious formula injection. Specific detection depends on how arbitrary log messages can be created (e.g., via SCIL scripts or SYS600 broker).

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains ".csv" and (CommandLine contains "=" or CommandLine contains "+" or CommandLine contains "-" or CommandLine contains "@")
| where FolderPath contains "SYS600"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, CommandLine, FileName, FolderPath

Splunk SPL

index=* (sourcetype=sys600 OR sourcetype=scil_logs) (csv OR log) (("=" OR "+" OR "-" OR "@") AND (script OR broker OR log_message))
| table _time, host, source, sourcetype, _raw

Sigma

title: SYS600 CSV Injection Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential CSV injection attempts in SYS600 by looking for suspicious characters in log-related events.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '.csv'
      - '='
      - '+'
      - '-'
      - '@'
    Image|endswith:
      - '\SYS600\*'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
tags:
  - attack.initial_access
  - attack.t1566.001

Elastic ES|QL

from process where process.command_line : ".csv" and (process.command_line : "=" or process.command_line : "+" or process.command_line : "-" or process.command_line : "@") and process.executable.path : "*SYS600*"
| project @timestamp, host.name, process.command_line, process.executable.path, process.name

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:hitachienergy:microscada_x_sys600:*:*:*:*:*:*:*:*

Referenzen