Hitachi Energy TRO600 flaws leak files and reach localhost services
An unauthenticated attacker can read configuration and password files; the fixes are 9.1.2.0 and 9.2.2.1.
57
Vulnerability1 · 1 read
CVE-2026-106087
Unauthenticated arbitrary file read in Hitachi Energy TRO600
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
TRO600 has an arbitrary file read flaw. An unauthenticated attacker on the network can read or download arbitrary files on the device, including configuration files and password data, and thereby obtain sensitive information. Hitachi Energy has not listed affected builds or a fixed release.
What to do: Apply Hitachi Energy's update for CVE-2026-106087 when it is available. No workaround is stated.
| Product | Affected |
|---|---|
| Hitachi Energy TRO600 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
- Weakness
- CWE-306
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X