Which versions of Reb500 Firmware are affected by CVE-2026-2459?

A privilege escalation vulnerability in REB500 allows authenticated users with Installer role to access and modify files and directories beyond their authorization level, potentially compromising…

How to fix or mitigate CVE-2026-2459?

Within 24 hours: Identify all REB500 instances in your environment and document current Installer role users. Within 7 days: Implement access controls to restrict Installer role scope, enable enhanced logging for file access/modifications, and audit recent directory changes. Within 30 days: Evaluate alternative products or isolated deployment architectures; establish a vendor communication channel to track patch availability and apply immediately upon release.

Reb500 Firmware CVE-2026-2459

Q: What is the CVSS score of CVE-2026-2459?

CVE-2026-2459 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Privilege Defined With Unsafe Actions (CWE-267)

2026-02-24 cybersecurity@hitachienergy.com

Information Disclosure Reb500 Firmware

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 14:16 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.

AnalysisAI

Authenticated users with Installer role in REB500 firmware can bypass directory access controls to read and modify files outside their authorized scope. This privilege escalation affects systems where installer accounts are provisioned, enabling unauthorized data access and manipulation. No patch is currently available.

Technical ContextAI

Affects Reb500 Firmware. A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.