The vulnerabilities are NULL pointer dereference, access of resource using incompatible type (type confusion), use after free, cleartext transmission of sensitive information, insufficiently protected credentials, authentication bypass by capture-replay, and authentication bypass by primary weakness.
These vulnerabilities, which Hitachi Energy self-reported, could have impact on confidentiality, integrity and availability of the product.
RTU500 series CMU Firmware is the operating system software for the Communication Unit (CMU) modules in Hitachi Energy’s RTU500 series Remote Terminal Units. These devices manage substation automation, grid control, and data communication between field sensors and SCADA systems.
The following versions of Hitachi Energy RTU500 Product suffer from the vulnerabilities:
- RTU500_series_CMU_Firmware from version 13.5.1 to 13.5.4
- RTU500_series_CMU_Firmware from version 13.6.1 to 13.6.3
- RTU500_series_CMU_Firmware from version 13.7.1 to 13.7.8
- RTU500_series_CMU_Firmware from version 13.8.1 to 13.8.2
- RTU500_series_CMU_Firmware from version 12.7.1 to 12.7.7
NULL Pointer Dereference
In one issue, RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.
CVE-2026-17539 is the case number for the vulnerability, which has a CVSS V3 base score of 5.9.
Additionally, a vulnerability exists in OpenSSL library component of RTU500 used for secure HTTPS access, authenticating and establishing encrypted communications with other devices. When processing a malformed delta CRL with a Delta CRL Indicator but no required CRL Number extension, OpenSSL may dereference a NULL pointer, causing a Denial of Service during X.509 certificate verification. Exploitation requires delta CRL processing to end up enabled, a relevant freshest CRL condition to be present, and an attacker-supplied malformed CRL. The issue can cause Denial of Service, but cannot lead to code execution or memory disclosure.
CVE-2026-28388 is the case number for the vulnerability, which has a CVSS V3 base score of 7.5.
Also, the XML-based services used in RTU500 has a vulnerability while processing a specially crafted XSD-validated XML document may trigger a type confusion error in libxml2. An attacker could exploit this condition to cause a denial of service.
CVE-2026-6732 is the case number for the vulnerability, which has a CVSS V3 base score of 7.5.
Denial of Service
Meanwhile, the XML-based services used in RTU500 has a vulnerability, where a use-after-free vulnerability in the xmlParseInternalSubset function of libxml2 may trigger by processing specially crafted XML input. Improper handling of entity resolution can allow a remote attacker to cause a denial of service.
CVE-2026-6653 is the case number for the vulnerability, which has a CVSS V3 base score of 8.8.
Moreover, a vulnerability exists in the web-based management and services functions of RTU500 using libcurl library, when a custom `Host:` header is first set for an HTTP request and a second request subsequently occurs using the same easy handle but without the custom `Host:` header set, the second request would use leaked stale information and pass on cookies meant for the first host in the second request.
CVE-2026-6276 is the case number for the vulnerability, which has a CVSS V3 base score of 7.5.
Furthermore, a vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. libcurl may fail to clear proxy authentication credentials when instructed to do so. As a result, stale credentials can end up reused by subsequent transfers that should not access them, potentially exposing sensitive proxy authentication information.
CVE-2026-9079 is the case number for the vulnerability, which has a CVSS V3 base score of 5.3.
Indeed, a vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. When the same libcurl handle ends up reused after a transfer to one HTTP origin using Digest authentication, libcurl may incorrectly send the Authorization header intended for the first origin to a second origin. This can disclose authentication information to an unintended host.
CVE-2026-11856 is the case number for the vulnerability, which has a CVSS V3 base score of 8.1.
Proxy Authentication
Additionally, a vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, libcurl may fail to clear proxy authentication state between requests. This can leak the Proxy-Authorization header intended for one proxy to another proxy.
CVE-2026-8927 is the case number for the vulnerability, which has a CVSS V3 base score of 5.3.
Also, a vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. libcurl may reuse an existing connection even after mTLS-related configuration options, especially client certificate or private key settings, have changed. This can bypass the intended authentication configuration and allow use of a connection that should no longer end up reused.
CVE-2026-8932 is the case number for the vulnerability, which has a CVSS V3 base score of 7.5.
The product sees use mainly in the energy sector, and on a global basis.
In terms of mitigations, for the most part versions can update to CMU Firmware version 13.9.1
Click on advisory for other potential update versions when available.
For additional information and support please contact your product provider or the Hitachi Energy service organization.
Best Practices
Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network.
Such practices include process control systems end up physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and have separation from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case.
Additionally, process control systems should not end up used for Internet surfing, instant messaging, or receiving emails. Portable computers and removable storage media should end up carefully scanned for viruses before they connect to a control system. Furthermore, users should follow proper password policies and processes.
Additional information on Industrial Control Systems Cybersecurity Best Practices is available in the Hitachi Energy’s “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification.