Six Vulnerabilities Discovered in Hitachi Energy RTU500 End-of-Life Firmware

Hitachi Energy has published a cybersecurity advisory in response to security findings reported by Dragos, affecting end-of-life RTU500 CMU firmware version 11.x and prior. Six vulnerabilities have been identified, impacting legacy firmware developed according to cybersecurity practices that existed at the time of release. As threat landscapes have evolved, these end-of-life versions no longer incorporate many of the security controls and hardening measures standard in modern industrial control systems.

The following vulnerabilities were reported:
- CVE-2026-8065: An authentication bypass vulnerability in the firmware update endpoint that allows an unauthenticated attacker to upload arbitrary firmware via a crafted POST request, potentially compromising device integrity or availability.
- CVE-2026-8066: A relative path traversal vulnerability in the file upload functionality that allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system.
- CVE-2026-8067: An improper authorization vulnerability in the web application that allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint, causing temporary device unavailability.
- CVE-2010-2965, CVE-2014-9195, and CVE-2023-46143: Additional vulnerabilities listed in the advisory.

CVSS v3 Base Scores for CVE-2026-8065 and CVE-2026-8066 are both 9.1 (CRITICAL), with vector strings CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. CVE-2026-8067 has a CVSS v3 Base Score of 3.1.

Hitachi Energy states that the findings do not affect currently supported RTU500 CMU firmware versions. End-of-life versions are no longer maintained with security updates. The vendor strongly recommends upgrading to a currently supported RTU500 firmware version (12.7.8 or 13.9.1 or latest) and implementing appropriate defense-in-depth measures and cybersecurity best practices to reduce risk.

CISA has issued ICS Advisory ICSA-26-279-06 covering these vulnerabilities. Affected equipment includes Hitachi Energy RTU500 series CMU firmware deployed worldwide, primarily in the Energy Critical Infrastructure sector.