EUVD-2026-110818
GHSA-5xj2-3wq5-8chm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device management interface over network
-
ExploitSend crafted file-read request unauthenticated
-
ExecutionRetrieve configuration and password files
-
ImpactHarvest credentials for follow-on access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against the TRO600 Series management interface (CVSS AV:N/AC:L/PR:N/UI:N), affecting firmware versions 9.0.0.0 through 9.1.1.0. The attacker only needs network reachability to the device. Limiting factors: exploitation requires network-layer access to the device's affected service, so TRO600 units deployed on isolated or firewalled OT/management networks are substantially less exposed than internet- or flat-network-reachable units; the exact vulnerable endpoint/trigger is not detailed in the available sources. Impact is confidentiality-only (file disclosure); it does not directly alter or disrupt device operation. |
| Impact | This is a genuine priority within its deployment niche, though the real-world risk is bounded by product footprint rather than exploitability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability impact - consistent with CWE-306 (missing authentication for a critical function) and the arbitrary-file-read described. The vendor-assigned score of 8.7 (High) is credible on the confidentiality dimension alone. Mitigating the urgency: there is no CISA KEV listing, no EPSS score supplied, and no public exploit or PoC reference in the provided data, so there is no evidence of active or imminent mass exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a serious-but-not-fire-drill posture. The practical risk driver is that disclosed files include configuration and password data, which can seed follow-on authenticated compromise; this elevates the effective impact beyond a simple read. EPSS data is absent, so exploitation probability cannot be quantified from the input. |
| Exploit ScenarioDerived | An attacker with network reachability to a TRO600 device's management interface sends a request to the vulnerable file-read function without supplying any credentials and retrieves sensitive files, including configuration and stored password data. No public exploit code or PoC reference is present in the supplied data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special conditions are required beyond network access to the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unauthenticated arbitrary file read in Hitachi Energy TRO600 Series firmware 9.0.0.0 through 9.1.1.0 lets remote attackers with network reachability to the device's management interface disclose sensitive files, including configuration and password data. The flaw is a missing-authentication condition (CWE-306) with confidentiality-only impact, and the available intelligence does not confirm active exploitation; no public exploit identified at time of analysis. Risk is real within the product's deployment niche but bounded by footprint and exposure.
RemediationAI
No fixed firmware version is listed in the provided data; consult Hitachi Energy's advisory at https://publisher.hitachienergy.com/preview?DocumentID=8DBD000224&LanguageCode=en&DocumentPartId=&Action=Launch for the vendor's fixed release and update instructions, and apply the fixed firmware for the 9.0.0.0 through 9.1.1.0 range when identified. Given the this_week priority label, review exposure and schedule remediation this week. Because exploitation requires only network reachability to the affected management interface, reduce exposure in the interim by restricting access to that interface to trusted management hosts and networks, placing TRO600 devices behind OT firewalls and segmentation, and removing internet or flat-network reachability; the trade-off is reduced remote administrative convenience and a need for jump hosts or VPN access. Endpoint-level blocking cannot be specified from the available data because the exact vulnerable endpoint and trigger are not detailed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TRO600 Series is Hitachi Energy device firmware identified by CPE cpe:2.3:a:hitachi_energy:tro600_series_firmware. The root-cause class is CWE-306, Missing Authentication for Critical Function: a file read/download capability is reachable without an authentication check, so requests to the management interface can retrieve files the attacker should not access. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning remote unauthenticated exploitation with no user interaction and confidentiality-only impact; the CVSS:4.0 vector likewise has VC:H and no VI/VA. The exact vulnerable endpoint or trigger is not described in the available sources, and the only affected firmware range supplied is 9.0.0.0 through 9.1.1.0.
Know when Tro600 Series Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network file read (PR:N, AV:N, AC:L) with high confidentiality impact disclosing credentials; no integrity or availability impact, so I:N/A:N and scope unchanged.
Primary rating from Vendor (Hitachi Energy).
CVSS VectorVendor: Hitachi Energy
DescriptionCVE.org
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
Executive ViewAI
Hitachi Energy TRO600 Series firmware versions 9.0.0.0 through 9.1.1.0 contain an unauthenticated arbitrary file read vulnerability that allows an attacker with network access to the management interface to access sensitive files, including configuration and password data. This flaw primarily threatens the confidentiality of critical infrastructure devices, potentially exposing credentials that could be used to compromise the broader operational network. Leadership should prioritize remediation because of the high severity and the sensitive nature of the affected devices, despite no confirmed active exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation to limit reachability to the management interface, enforcing firewall rules to allow only trusted hosts, disabling unused services, and monitoring for anomalous file access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB