CVE-2026-8065
CriticalCVSS 9.1Summary
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
Risk Assessment
An attacker can remotely upload malicious firmware without authentication, taking control of the RTU500 device and threatening the integrity and availability of the control system.
Recommendation
Update Hitachi Energy RTU500 firmware to a patched version and secure the firmware update endpoint through network segmentation and access controls.
Other vulnerabilities in Hitachi Energy RTU500
Original NVD description (English source)
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS