Hitachi Energy vulnerabilities
118 CVEs and advisories name Hitachi Energy as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-106087TRO600 contains an arbitrary file read vulnerability.
- CVE-2026-10756TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended…
- CVE-2026-13162An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system…
- CVE-2026-11796Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleR
- CVE-2026-7395Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to
- CVE-2026-8067An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the
- CVE-2026-8066A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated
- CVE-2026-8065An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticat
- CVE-2026-17539RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference
- CVE-2026-9854A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to adminis
- CVE-2026-9853A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read a
- CVE-2026-9852A CSV injection vulnerability exists in SYS600.
- CVE-2026-10763PROMOD V is using insecure HTTP communication instead of HTTPS.
- CVE-2026-8479IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of mess
- CVE-2026-7310A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw.
- CVE-2026-2460A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using
- CVE-2026-2459A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role
- CVE-2026-1773IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame.
- CVE-2026-1772RTU500 web interface: An unprivileged user can read user management information.
- CVE-2025-7740Use of default credentials vulnerability in Hitachi Energy SuprOS product
- CVE-2025-1038The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authentica
- CVE-2025-1037By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands
- CVE-2025-1036Command injection vulnerability exists in the “Logging” page of the web-based configuration utility.
- CVE-2025-10217A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject craft
- CVE-2025-39205A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product.
- CVE-2025-39204A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product.
- CVE-2025-39203A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product.
- CVE-2025-39202A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product.
- CVE-2025-39201A vulnerability exists in MicroSCADA X SYS600 product.
- CVE-2025-2403A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and S