Hitachi Energy

Latest CVEs · RSS

• CVE-2026-11796 2026-09-29 · CVSS 5.1
  Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which
• CVE-2026-7395 2026-09-29 · CVSS 8.5
  Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosu
• CVE-2026-8067 2026-09-29 · CVSS 6.5
  An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot thr
• CVE-2026-8066 2026-09-29 · CVSS 9.1
  A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write o
• CVE-2026-8065 2026-09-29 · CVSS 9.1
  An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to uploa
• CVE-2026-17539 2026-09-03 · CVSS 5.9
  RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of
• CVE-2026-9854 2026-09-03 · CVSS 8.5
  A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the
• CVE-2026-9853 2026-09-03 · CVSS 8.5
  A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify applicatio
• CVE-2026-9852 2026-09-03 · CVSS 4.6
  A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in som
• CVE-2026-10763 2026-06-30 · CVSS 7.0
  PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server.
• CVE-2026-8479 2026-05-26 · CVSS 6.9
  IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a c
• CVE-2026-7310 2026-05-26 · CVSS 4.4
  A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious user with local access can exploit this
• CVE-2026-2460 2026-02-24 · CVSS 7.6
  A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol th
• CVE-2026-2459 2026-02-24 · CVSS 7.4
  A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized t
• CVE-2026-1773 2026-02-24 · CVSS 8.7
  IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-direct
• CVE-2026-1772 2026-02-24 · CVSS 5.3
  RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requir
• CVE-2025-7740 2026-01-28 · CVSS 8.8
  Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created durin
• CVE-2025-1038 2025-10-28 · CVSS 7.5
  The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high p
• CVE-2025-1037 2025-10-28 · CVSS 7.5
  By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access vi
• CVE-2025-1036 2025-10-28 · CVSS 8.7
  Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access fo
• CVE-2025-10217 2025-09-30 · CVSS 6.0
  A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile f
• CVE-2025-39205 2025-06-24 · CVSS 6.5
  A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack du
• CVE-2025-39204 2025-06-24 · CVSS 8.5
  A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data can
• CVE-2025-39203 2025-06-24 · CVSS 6.5
  A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can cause a denial
• CVE-2025-39202 2025-06-24 · CVSS 8.3
  A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files