Multiple Vulnerabilities Discovered in Hitachi Energy RTU500 Series CMU Firmware

Hitachi Energy has identified seven vulnerabilities affecting the RTU500 series CMU Firmware used in its RTU500 product line. The affected versions span multiple firmware releases: RTU500 series CMU Firmware versions 13.5.1 through 13.5.4, 13.6.1 through 13.6.3, 13.7.1 through 13.7.8, 13.8.1 through 13.8.2, and 12.7.1 through 12.7.7.

The vulnerability types include NULL pointer dereference, access of resource using incompatible type (type confusion), use after free, cleartext transmission of sensitive information, insufficiently protected credentials, authentication bypass by capture-replay, and authentication bypass by primary weakness.

CVE-2026-17539 specifically involves a NULL pointer dereference that occurs under high-load scenarios when GI requests are sent at short intervals. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, ultimately leading to a denial of service for bidirectional IEC 60870-5-104 communication.

CVE-2026-28388 affects the OpenSSL library component used for secure HTTPS access and encrypted communications. When processing a malformed delta CRL with a Delta CRL Indicator but no required CRL Number extension, OpenSSL may dereference a NULL pointer, causing a Denial of Service during X.509 certificate verification. Exploitation requires delta CRL processing to be enabled, a relevant freshest CRL condition to be present, and an attacker-supplied malformed CRL.

The CVSS v3 base score for CVE-2026-17539 is 5.9 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The advisory notes that CVE-2026-28388 is limited to Denial of Service and cannot lead to code execution or memory disclosure.

Affected countries deploy worldwide, with the critical infrastructure sector identified as Energy. Hitachi Energy's headquarters are located in Switzerland.

Vendor remediation requires updating to CMU Firmware version 13.9.1 for most affected release series. Specific upgrade paths vary by current version, with some requiring intermediate updates or offering multiple upgrade options.