SHIFTWIRE
Log inGet Early Access
BACK TO THE WIRE
SW-000333HITACHI ENERGY · RTU500 SERIES CMU FIRMWARE · RTU500 PRODUCTHIGHACTION REQUIRED

CISA/Hitachi Energy advisory: multiple vulnerabilities in RTU500 CMU Firmware (CVSS up to 8.8)

CISA republished a Hitachi Energy PSIRT advisory covering seven vulnerabilities (CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932) affecting RTU500 series CMU Firmware versions 12.7.1-12.7.7, 13.5.1-13.5.4, 13.6.1-13.6.3, 13.7.1-13.7.8, and 13.8.1-13.8.2. The issues stem from NULL pointer dereference, type confusion, use-after-free, and credential/cleartext handling flaws in embedded OpenSSL, libxml2, and libcurl components, and can cause denial of service or credential exposure on energy-sector RTU devices.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORY

PUBLISHED OCT 23, 2026 19:48 UTC

WHAT CHANGED

Hitachi Energy disclosed nine CVEs across multiple CWE categories (NULL pointer dereference, type confusion, use-after-free, cleartext transmission, insufficiently protected credentials, authentication bypass by capture-replay, authentication bypass by primary weakness) impacting specific version ranges of RTU500 series CMU Firmware. Vendor fixes are available: update to CMU Firmware 13.9.1 for most affected branches, or to 12.7.8 for the 12.7.x branch; fixes for 13.7.x (13.7.9) and 13.8.x (13.8.3) are noted as upcoming or available. CISA republished the vendor's CSAF advisory verbatim on 2026-10-20 after initial vendor publication on 2026-09-01 and an update on 2026-09-29 regarding the 12.7.8 fix.

WHY IT MATTERS

RTU500 devices are used worldwide in energy-sector industrial control systems; successful exploitation could disrupt IEC 60870-5-104 communications (denial of service), expose authentication or proxy credentials, or bypass intended TLS/authentication configurations via reused libcurl connections. Administrators operating affected firmware versions should prioritize patching given CVSS scores reaching 8.8, and should apply standard ICS network isolation and VPN-based remote access practices in the interim.

WHO IS AFFECTED

PRODUCTS
Hitachi Energy RTU500 ProductRTU500 series CMU Firmware
CONFIGURATIONS
CMU Firmware 13.5.1–13.5.4CMU Firmware 13.6.1–13.6.3CMU Firmware 13.7.1–13.7.8CMU Firmware 13.8.1–13.8.2CMU Firmware 12.7.1–12.7.7
REGIONS
Worldwide
ENVIRONMENTS
Energy sector critical infrastructure

WHAT TO DO

  1. 01
    HIGH

    Update RTU500 CMU Firmware versions 13.5.1–13.5.4 and 13.6.1–13.6.3 to version 13.9.1.

  2. 02
    HIGH

    Update RTU500 CMU Firmware versions 13.7.1–13.7.8 to version 13.9.1, or to 13.7.9 when it becomes available.

  3. 03
    HIGH

    Update RTU500 CMU Firmware versions 13.8.1–13.8.2 to version 13.9.1 or 13.8.3.

  4. 04
    HIGH

    Update RTU500 CMU Firmware versions 12.7.1–12.7.7 to version 12.7.8, or upgrade directly to version 13.9.1.

  5. 05
    HIGHAUTOMATABLE

    Minimize network exposure of RTU500 devices and ensure they are not directly accessible from the internet.

  6. 06
    MEDIUM

    Place RTU500 control system networks and remote devices behind firewalls, isolated from business networks.

  7. 07
    MEDIUM

    Require VPN use for any remote access to RTU500 systems, keeping VPN software updated to the latest version.

TIMELINE

ANNOUNCED
OCT 20, 2026

SOURCES

  • OFFICIAL SECONDARYCISA

    Hitachi Energy RTU500 Product

    PUBLISHED OCT 20, 2026VIEW SOURCE

VERIFICATION

HUMAN VERIFIEDLAST VERIFIED OCT 23, 2026 19:48 UTCREVISION 2

ShiftWire summarizes and analyzes changes from the cited sources. Always review the primary source before implementing material changes.

WAS THIS USEFUL?