Hitachi Energy TRO600 flaws allow config and password file reads
First merged summary.
CISA says two Hitachi Energy TRO600 flaws are fixed in 9.2.2.1 and 9.1.2.0, with no known exploitation.
Hitachi Energy reported two vulnerabilities in TRO600 series products used in the energy sector. CVE-2026-106087 lets an unauthenticated attacker read or download arbitrary files, including configuration and password data. CVE-2026-10756 lets an authenticated attacker use port forwarding to reach services meant only for localhost. CISA says the 9.2 branch through 9.2.1.6 is fixed in 9.2.2.1 and the 9.1 branch in 9.1.2.0, and its SSVC lists exploitation as none. On October 27, the Canadian Centre for Cyber Security listed TRO600 firmware before 9.2.2.1 in advisory AV26-1091, along with several HiRDB and JP1 products, but gave no CVE identifiers or exploitation status.
- CVE-2026-106087 is an unauthenticated arbitrary file read, scored CVSS 7.5 and CVSS 4.0 8.7.
- CVE-2026-10756 is an authenticated port-forwarding issue reaching localhost-only services.
- Fixes are firmware 9.2.2.1 for affected 9.2 builds and 9.1.2.0 for the 9.1 branch.
- CISA’s SSVC lists exploitation as none; Hitachi Energy’s internal team reported both issues.
- CCCS advisory AV26-1091 also names HiRDB Server and several JP1 components without CVE IDs.
Timeline
dated events in the reporting · oldest first- Oct 27, 2026CCCS issues AV26-1091 covering Hitachi products including TRO600 · Canadian Centre for Cyber Security
- Oct 29, 2026CISA details two TRO600 vulnerabilities and available fixes · CISA Advisories
What each outlet adds
beyond the shared facts- CISA AdvisoriesNames both CVEs, scores, fixed builds, and no known exploitation.
- Canadian Centre for Cyber SecurityLists HiRDB and JP1 products in AV26-1091 without CVE details.
Coverage
oldest first · one row per article · UTC- · 3d ago
Canadian Centre for Cyber SecurityFirst report
Hitachi HiRDB, JP1 and TRO600 firmware affected by vulnerabilities
The October 27 bulletin lists many HiRDB and JP1 builds plus TRO600 firmware before 9.2.2.1, with no CVEs or exploitation status.
- · 1d ago
CISA Advisories
Hitachi Energy TRO600 flaws leak files and reach localhost services
An unauthenticated attacker can read configuration and password files; the fixes are 9.1.2.0 and 9.2.2.1.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-106087+1 related CVE | Unauthenticated arbitrary file read in Hitachi Energy TRO600 | 8.7 group max | — |