CVE-2026-17539
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
RTU500 has a vulnerability where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.
Risk Assessment
The risk is the potential disruption of communication in industrial automation systems, which could lead to loss of monitoring or control, and consequently to failures or safety hazards.
Recommendation
Limit the frequency of GI requests and upgrade RTU500 firmware to a patched version if available.
Other vulnerabilities in RTU500
See all- CVE-2026-8067Medium
The RTU500 web application has an improper authorization vulnerability that allows an authenticated user to trigger a device reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.
- CVE-2026-8479Medium
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable to NULL pointer dereference when a specially crafted sequence of messages is sent for a certain time, causing Denial of Service. The product is only affected if BCI is configured.
Original NVD description (English source)
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS