Hitachi Energy TRO600 flaws leak files and reach localhost services
Original title: Hitachi Energy TRO600 series products
An unauthenticated attacker can read configuration and password files; the fixes are 9.1.2.0 and 9.2.2.1.
Hitachi Energy reported two vulnerabilities in TRO600 series products deployed in the energy sector. CVE-2026-10756 lets an authenticated attacker use port forwarding to reach services intended only for localhost, exposing sensitive functions and information. CVE-2026-106087 lets an unauthenticated attacker read or download arbitrary files, including configuration and password data. Affected 9.2 and 9.1 branches have fixes in 9.2.2.1 and 9.1.2.0. CISA’s SSVC lists exploitation as none.
Unconfirmed: The advisory summary says the flaws can support remote code execution, but the two described bugs are access bypass and file read.
- CVE-2026-10756 is fixed by updating 9.2.1.6 and prior to 9.2.2.1.
- CVE-2026-106087 scores CVSS 7.5 and CVSS 4.0 8.7.
- The 9.1 branch is fixed in 9.1.2.0, with 9.2.2.1 called the latest.
- Hitachi Energy’s internal team reported both issues to CISA.
Impact: Arbitrary file and password disclosure, plus access to localhost services
| Product | Affected | Fixed in |
|---|---|---|
| Hitachi Energy TRO600 | 9.2.1.6 and prior | 9.2.2.1 |
| Hitachi Energy TRO600 | 9.1.1.0 and prior | 9.1.2.0 |
- 1.Update TRO600 9.2.1.6 and prior to 9.2.2.1.
- 2.Update the 9.1 branch to 9.1.2.0 or the latest 9.2.2.1.
- Vendors
- Hitachi Energy
- Products
- TRO600
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-106087+1 related CVE | Unauthenticated arbitrary file read in Hitachi Energy TRO600 | 8.7 group max | — |
From the original article
4 min read at cisa.govView CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information. Please refer to the Recommended Immediate Actions section for information about the mitigation/remediation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.