CISA Advises of Critical Vulnerabilities in Hitachi Energy TRO600 Series Products

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-302-02 on October 29, 2026, disclosing multiple vulnerabilities affecting Hitachi Energy TRO600 series products. The affected versions include TRO600/<=9.2.1.6, TRO600/<=9.1.1.0, 9.2.2.1, and 9.1.2.0.

CVE-2026-10756 is an authenticated vulnerability that allows an attacker to bypass network access restrictions. By leveraging port forwarding, the attacker can interact with locally bound ports and services, potentially gaining unauthorized access to sensitive functionality and confidential information, with impact on availability. The CVSS v3.1 base score is 7.5 (HIGH), with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

CVE-2026-106087 is an unauthenticated arbitrary file read vulnerability. An attacker without credentials can exploit this flaw to read or download arbitrary files on the affected device, including sensitive configuration files and password data, leading to disclosure of sensitive information. The CVSS v3.1 base score is 7.5, and the v4.0 base score is 8.7 (HIGH), with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.

Hitachi Energy reported these vulnerabilities internally and has released mitigations. The vendor fix involves updating to version 9.2.2.1, which addresses both CVEs. Version 9.1.2.0 also resolves CVE-2026-106087. Hitachi Energy recommends applying the latest software update and reviewing firewall and network segmentation practices, particularly for critical infrastructure environments.

The advisory notes that these products are deployed worldwide, with the company headquartered in Switzerland. The Energy sector is identified as a critical infrastructure sector affected by these flaws.