cybersecurity@hitachienergy.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS cybersecurity@hitachienergy.com
03
assessed vulnerabilities (118)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-8067US | —OT elevated | — | ||
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpo… | ||||
| CVE-2026-8066US | — | — | ||
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrar… | ||||
| CVE-2026-8065US | —OT elevated | Exploit | ||
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware… | ||||
| CVE-2026-7395US | —OT elevated | — | ||
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity com… | ||||
| CVE-2026-11796US | —OT elevated | — | ||
Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in deni… | ||||
| CVE-2026-9854US | high7.8 | — | ||
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows h… | ||||
| CVE-2026-9853US | high7.8 | — | ||
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without be… | ||||
| CVE-2026-9852US | high7.8 | — | ||
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending o… | ||||
| CVE-2026-17539US | — | — | ||
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced messag… | ||||
| CVE-2026-10763US | — | — | ||
PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server. | ||||
| CVE-2026-8479US | — | — | ||
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable
for a NULL pointer dereferencing, if a specially crafted
sequence of messages is sent for a certain time, causing… | ||||
| CVE-2026-7310US | — | — | ||
A heap-based buffer overflow vulnerability exists in XML
parser functionality in the HiDraw. An authenticated
malicious user with local access can exploit this
vulnerability using… | ||||
| CVE-2026-2460US | high8.1 | — | ||
A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not a… | ||||
| CVE-2026-2459US | high8.1 | — | ||
A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so. | ||||
| CVE-2026-1773US | high7.5 | — | ||
IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality… | ||||
| CVE-2026-1772US | medium5.3 | — | ||
RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requires further tools lik… | ||||
| CVE-2025-7740US | —OT elevated | — | ||
Default credentials vulnerability exists in SuprOS
product. If exploited, this could allow an authenticated
local attacker to use an admin account created during
product deployment… | ||||
| CVE-2025-1038US | — | — | ||
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject… | ||||
| CVE-2025-1037US | — | — | ||
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH)… | ||||
| CVE-2025-1036US | — | — | ||
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration… | ||||