Vulnerability in Hitachi Energy RTU500 series CMU firmware

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.1

[ Description ]Official description

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund29 Sep 2026WID-SEC-2026-3658

  Hitachi Energy RTU500: Multiple vulnerabilities Translated from German

  CVE-2023-46143CVE-2010-2965CVE-2026-8065+3 more CVEs

[ References ]References

• publisher.hitachienergy.com/preview