Hitachi Energy TRO600 flaws leak files and reach localhost services
An unauthenticated attacker can read configuration and password files; the fixes are 9.1.2.0 and 9.2.2.1.
57
Vulnerability1 · 1 read
CVE-2026-10756
Authenticated localhost access bypass in TRO600 via port forwarding
- CVSS 4.0
- 7.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
TRO600 lets an authenticated attacker bypass network access restrictions and reach services meant to be available only on localhost. From the network, with low privileges and no user interaction, the attacker uses port forwarding to talk to locally bound ports and services. That yields sensitive functions and confidential data and can affect availability. Affected builds are not stated.
What to do: Apply Hitachi Energy's update for CVE-2026-10756. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Hitachi Energy TRO600 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.
- Weakness
- CWE-923
- Vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X