6.5
Medium
CVE-2026-8067 An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an…
Description
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RTU500 series CMU Firmware 9.0 | 9.0 → < 12.0 | 12.0 |
Other CVEs of RTU500 series CMU Firmware
The 13 CVEs of RTU500 series CMU Firmware →
CVE-2026-8066
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions…
9.1
Critical
CVE-2026-8065
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions…
9.1
Critical
CVE-2026-17539
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a…
5.9
Medium
CVE-2026-8479
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially…
6.9
Medium