9.1
Critical
CVE-2026-8066 A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions…
Description
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RTU500 series CMU Firmware 9.0 | 9.0 → < 12.0 | 12.0 |
Other CVEs of RTU500 series CMU Firmware
The 13 CVEs of RTU500 series CMU Firmware →
CVE-2026-8067
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an…
6.5
Medium
CVE-2026-8065
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions…
9.1
Critical
CVE-2026-17539
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a…
5.9
Medium
CVE-2026-8479
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially…
6.9
Medium