Hitachi Energy RTU500 CMU firmware flaws can disrupt ICS communications
Original title: Hitachi Energy RTU500 Product
Builds from 12.7.1 through 13.8.2 should move to 13.9.1 or named branch fixes; exploitation is not stated.
A CISA ICS advisory says Hitachi Energy RTU500 series CMU firmware flaws can affect confidentiality, integrity, and availability. Detailed issues include a NULL-pointer denial of service in IEC 60870-5-104 handling and an OpenSSL delta-CRL crash limited to denial of service. Fixes point to CMU firmware 13.9.1, with branch updates 12.7.8, 13.8.3, and 13.7.9 when available.
Unconfirmed: The notice is truncated, and 13.7.9 is described as not yet available.
- The vendor equipment score listed is CVSS v3 8.8 across seven vulnerability classes.
- CVE-2026-17539 is CVSS 5.9 and can restart IEC 104 communication.
- CVE-2026-28388 requires delta CRL processing and cannot yield code execution.
- Deployments are described as worldwide in the energy sector; headquarters is Switzerland.
Impact: Confidentiality, integrity, or availability loss, including denial of service
| Product | Affected | Fixed in |
|---|---|---|
| Hitachi Energy RTU500 series CMU Firmware | 12.7.1–12.7.7, 13.5.1–13.5.4, 13.6.1–13.6.3, 13.7.1–13.7.8, 13.8.1–13.8.2 | 13.9.1; 12.7.8; 13.8.3; 13.7.9 when available |
- 1.Update affected CMU firmware to 13.9.1, or to 12.7.8 or 13.8.3 where specified.
- 2.Use 13.7.9 on the 13.7 branch when Hitachi Energy makes it available.
- 3.Apply the advisory's general mitigations until firmware is updated.
- CVEs
- CVE-2026-17539CVE-2026-28388CVE-2026-6732CVE-2026-6653CVE-2026-6276CVE-2026-9079CVE-2026-11856CVE-2026-8927CVE-2026-8932
- Vendors
- Hitachi Energy
- Products
- RTU500 series CMU Firmware
- Countries
- Switzerland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-9079+3 related CVEs | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for… | 9.8 group max | 1% | PoC | |
| CVE-2026-17539 | RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry… | 5.9 | <1% | ||
| CVE-2026-28388 | Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number… | 7.5 | <1% | ||
| CVE-2026-6276 | Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without… | 7.5 | <1% | PoC | |
| CVE-2026-6653 | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via… | 7.0 | <1% | PoC ×2 | |
| CVE-2026-6732 | libxml2: This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that… | 7.5 | <1% | PoC |
From the original article
11 min read at cisa.govView CSAF Summary Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.