SecBoard
Zurück zur CVE-Übersicht

CVE-2026-9854

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 7.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

Beschreibung

A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection for privilege escalation on Windows host by users of engineering tools.

Sentinel/Defender KQL

SecurityEvent | where EventID == 4672 and SubjectUserName contains "engineering_tool_user" and NewPrivileges contains "SeTakeOwnershipPrivilege"

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4672 Subject_User_Name=*engineering_tool_user* New_Privileges=*SeTakeOwnershipPrivilege*

Sigma

title: Windows Privilege Escalation via Engineering Tool
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4672
    SubjectUserName|contains: 'engineering_tool_user'
    NewPrivileges|contains: 'SeTakeOwnershipPrivilege'
  condition: selection
level: high

Elastic ES|QL

from security_event where event.id == 4672 and user.name : "*engineering_tool_user*" and winlog.event_data.NewPrivileges : "*SeTakeOwnershipPrivilege*"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:hitachienergy:microscada_x_sys600:*:*:*:*:*:*:*:*

Referenzen