RTU500 (Product): news timeline & CVEs

Hitachi Energy RTU500

CISA warns end-of-life Hitachi Energy RTU500 firmware has critical unauthenticated flaws, including arbitrary firmware upload.

CISA republished a Hitachi Energy advisory, based on Dragos findings, for end-of-life RTU500 series CMU firmware 11.x and earlier used in the energy sector. CVE-2026-8065 (CVSS 9.1) allows unauthenticated firmware upload, CVE-2026-8066 (CVSS 9.1) allows unauthenticated arbitrary file writes, and CVE-2026-8067 (CVSS 6.5) lets a low-privileged user reboot the device. Legacy issues include CVE-2010-2965, the Wind River VxWorks WDB agent on UDP port 17185, listed at CVSS 9.8, plus CVE-2014-9195 and CVE-2023-46143. Supported firmware is unaffected; Hitachi Energy recommends 12.7.8, 13.9.1, or later. Exploitation is not reported.

CISA AdvisoriesOct 6, 12:00 UTC · 2d agoAdvisory 4 sources CVE-2026-8065 CVE-2026-8066 CVE-2026-8067+3 CVEs3

Hitachi security advisory (AV26-975)

Canada's Cyber Centre warns that Hitachi Energy RTU500 CMU firmware has vulnerabilities needing updates.

The Canadian Centre for Cyber Security issued advisory AV26-975 stating that Hitachi Energy RTU500 series CMU firmware is affected by vulnerabilities. The notice covers firmware prior to 12.7.8 and 13.9.1 or later, including end-of-life versions. No CVE identifiers or exploitation details are included. The Cyber Centre urges administrators to review Hitachi's vulnerability information and apply updates as they become available.

Canadian Centre for Cyber SecuritySep 29, 15:49 UTC · 9d agoAdvisory

RTU500

Timeline2 articles

Related CVEsby mentions

Appears with

Hitachi Energy RTU500

Hitachi security advisory (AV26-975)