These vulnerabilities, which Hitachi self-reported, could end up exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information.
The Hitachi Energy TRO600 series is a portfolio of ruggedized, high-performance wireless routers and communication devices built for mission-critical industrial, utility, and smart city applications.
The following versions of Hitachi Energy TRO600 series products suffer from the vulnerabilities:
- TRO600 version up to and including 9.2.1.6
- TRO600 version up to and including 9.1.1.0
In one issue, TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.
CVE-2026-10756 is the case number for the vulnerability, which has a CVSS V3 base score of 7.5. There is a V4 base score of 7.7.
Arbitrary File Read
Additionally, TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
CVE-2026-106087 is the case number for the vulnerability, which has a CVSS V3 base score of 7.5. There is a V4 base score of 8.7.
The product sees use mainly in the energy sector and on a global basis.
In terms of mitigations:
CVE-2026-10756:
- TRO600 version 9.2.1.6 and prior, update to version 9.2.2.1
CVE-2026-106087:
- TRO600 version 9.2.1.6 and prior, no fix mentioned yet
- TRO600 version 9.1.1.0 and prior, fixed in version 9.1.2.0. Update to the latest version 9.2.2.1.
For additional information and support, contact your product provider or Hitachi Energy service organization.
Recommended security practices and firewall configurations can help protect an industrial control system network from attacks that originate from outside the network.
Such practices include that process control systems end up physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and remain separate from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case.
Industrial control systems should not be used for Internet surfing, instant messaging, or receiving emails. Portable computers and removable storage media should end up carefully scanned for viruses before they connect to a control system.
Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy’s “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification.