Hitachi Energy RTU500: 6 CVEs, Critical 9.8
Summary
CISA reports 6 vulnerabilities in Hitachi Energy RTU500 series CMU Firmware. Weakness types: Missing Authentication for Critical Function, Relative Path Traversal, Missing Authorization (+2 more). Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- Hitachi Energy
- Products
- RTU500 series CMU Firmware
- CVEs
- CVE-2026-8065, CVE-2026-8066, CVE-2026-8067, CVE-2010-2965, CVE-2014-9195, CVE-2023-46143
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy
- Deployed
- Worldwide
- Vendor HQ
- Switzerland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-8065 | Missing Authentication for Critical Function | 9.1 | – | No | CVE-2026-8065 |
| CVE-2026-8066 | Relative Path Traversal | 9.1 | – | No | CVE-2026-8066 |
| CVE-2026-8067 | Missing Authorization | 6.5 | – | No | CVE-2026-8067 |
| CVE-2010-2965 | Incorrect Authorization | 9.8 | – | No | CVE-2010-2965 |
| CVE-2014-9195 | Missing Authentication for Critical Function | 8.1 | – | No | CVE-2014-9195 |
| CVE-2023-46143 | Download of Code Without Integrity Check | 7.5 | – | No | CVE-2023-46143 |
Affected products (1)
- RTU500 series CMU Firmware versions 11.x and prior (End-of-Life)
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Upgrade to version 12.7.8 or 13.9.1 or latest
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-279-06
- Machine-readable CSAF record
- https://publisher.hitachienergy.com/preview?DocumentID=8DBD000235&LanguageCode=en&Document
- https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&Document
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.