CVE-2026-106087EUVD-2026-110818GHSA-5XJ2-3WQ5-8CHM
TRO600 contains an arbitrary file read vulnerability.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The TRO600 device's software contains a flaw that lets someone without a login read or download any file stored on the device. This can expose sensitive configuration files and password data, leading to the leak of confidential information.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Hitachi Energy TRO600 Series Firmware
From 9.0.0.0 · through 9.1.1.0