RTU500 Series CMU CVE-2026-8066

Requires network reachability to the RTU500 CMU file-upload functionality; no authentication, no privileges, and no user interaction are needed (PR:N/UI:N), and it works against the device's exposed upload interface without special configuration. The primary limiting factor is deployment topology rather than software preconditions: RTU500 units are substation devices normally placed on isolated/segmented OT networks, so an attacker must first gain access to that network segment or a reachable management path. Exploitation applies to affected RTU500 Series CMU firmware versions as enumerated in the Hitachi Energy advisory.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base 9.1) describes a network-reachable, low-complexity, unauthenticated, no-interaction path-traversal file write against an ICS/OT device - the kind of precondition profile that makes exploitation trivial once the endpoint is exposed. The C:N/I:H/A:H split is internally consistent with CWE-23: arbitrary file write/overwrite yields high integrity and availability impact (device data tampering, disrupted operation) but no direct confidentiality loss. EPSS, KEV, POC, and SSVC decision data were NOT provided in the input, so per precision rules there is no public exploit identified at time of analysis and no evidence of active exploitation - the score reflects potential, not observed, exploitation. The one mitigating real-world factor is that RTU500 devices are typically segmented on OT networks rather than internet-facing, which narrows the practical attacker population even though the vector is nominally AV:N. Priority remains elevated because of the critical-infrastructure context (substation automation) and unauthenticated write-to-filesystem capability.

An attacker with network reach to an RTU500 CMU's file-upload interface sends a crafted upload request containing directory-traversal sequences (e.g. ../) in the target path, writing or overwriting arbitrary files on the device filesystem without any credentials or user interaction. By overwriting configuration or firmware-support files, the attacker corrupts device data or halts the RTU's intended substation-control operation. No public proof-of-concept was provided in the input data.