CVE-2026-8066
CriticalCVSS 9.1Summary
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device's intended operation.
Risk Assessment
An unauthenticated attacker can remotely modify or overwrite files on the RTU500 device, potentially compromising data integrity and disrupting control infrastructure operations.
Recommendation
Update Hitachi Energy RTU500 firmware to a version containing the fix and restrict network access to the file upload interface to trusted networks only.
Other vulnerabilities in Hitachi Energy RTU500
Original NVD description (English source)
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS