Hitachi Energy RTU500
Hitachi Energy RTU500 firmware versions <=11.x affected by multiple critical vulnerabilities.
Hitachi Energy has issued a cybersecurity advisory detailing multiple vulnerabilities in end-of-life RTU500 CMU firmware versions 11.x and prior. These vulnerabilities, reported by Dragos, include authentication bypass, directory traversal, and improper authorization, with CVSS scores up to 9.8. Exploitation could lead to device compromise, data modification, or service disruption. Hitachi Energy strongly recommends upgrading to supported firmware versions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Hitachi Energy?
Get an email when a new story names Hitachi Energy, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHitachi Energy's RTU500 series, widely used in industrial control and energy grid environments, contains critical vulnerabilities in end-of-life firmware versions 11.x and prior, including authentication bypass (CVSS 9.8), directory traversal, and improper authorization flaws. Because the affected firmware is end-of-life, these versions no longer receive security patches, leaving organizations that have not upgraded exposed to complete device compromise, unauthorized data modification, and service disruption. This case highlights the significant risk of running legacy OT/ICS firmware in critical infrastructure where exploitation can have cascading physical consequences. Timely lifecycle management and proactive firmware upgrades are essential to maintaining the security posture of operational technology environments.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-8065
- cve — CVE-2026-8066
- cve — CVE-2026-8067
- cve — CVE-2010-2965
- cve — CVE-2014-9195
- cve — CVE-2023-46143