EUVD-2026-88666
GHSA-gg49-9mrv-ff3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RTU500 firmware-update endpoint over network
-
DeliverySend crafted POST request
-
ExploitBypass missing authentication (CWE-306)
-
ExecutionUpload arbitrary firmware
-
ImpactAlter device functionality or disable RTU
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the RTU500 CMU firmware-update endpoint and the ability to send a crafted POST request; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against affected firmware. The practical limiting factor is exposure: RTU500 devices are OT/ICS equipment typically deployed on segmented substation/utility networks, so reachability depends on whether the firmware-update interface is exposed to an attacker-reachable network rather than isolated behind ICS segmentation. There is no confidentiality impact (C:N), so the realistic outcome is malicious firmware installation affecting device integrity and availability. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H = 9.1) describes a remote, unauthenticated, low-complexity attack requiring no user interaction against the firmware-update endpoint of an OT/ICS device - CWE-306 (missing authentication) is consistent with the described crafted-POST firmware upload. The high integrity and availability impact is credible because unauthenticated firmware replacement lets an attacker alter or brick a substation RTU. However, several key exploitation signals are ABSENT: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the 9.1 reflects potential impact, not confirmed activity. The only source is the vendor's own advisory (Hitachi Energy self-reported), so affected-version detail and a fix are not independently corroborated here. Net: treat as urgent to patch given the unauthenticated network vector against grid infrastructure, while noting that no active exploitation or weaponization is evidenced. |
| Exploit ScenarioDerived | An attacker with network reachability to an exposed RTU500 CMU firmware-update endpoint sends a single crafted POST request carrying malicious firmware, bypassing authentication entirely (CWE-306). Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials, no user interaction, and no special timing are needed; successful upload lets the attacker alter device functionality or render the RTU unavailable. No public exploit code is identified at time of analysis, so this remains a demonstrated design flaw rather than a confirmed in-the-wild attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Unauthenticated attackers able to reach the firmware-update endpoint of Hitachi Energy RTU500 series CMU devices can upload arbitrary firmware through a crafted POST request, gaining control over device functionality without any credentials or user interaction (CVSS 9.1, CWE-306). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no public exploit identified at time of analysis, but the PR:N/UI:N vector means any reachable instance of the affected interface is directly exploitable. Because the impact is rated integrity-high and availability-high with no confidentiality impact (C:N), the realistic outcome is persistent unauthorized firmware that alters or disrupts the device rather than data theft.
RemediationAI
No fix version is specified in the available intelligence, so operators should obtain the vendor's corrected CMU firmware directly from the Hitachi Energy advisory (https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch) and treat patch availability as unconfirmed until that document is reviewed. Until a fixed build is applied, the most effective compensating control is to block network reachability to the firmware-update endpoint: enforce ICS segmentation so RTU500 CMU management interfaces are not reachable from corporate, engineering, or internet-facing networks, and restrict access to a hardened jump host or out-of-band management path; the trade-off is that legitimate remote firmware maintenance must then be performed from inside the trusted zone. If the platform permits, disable or lock down the remote firmware-update service entirely and require local/physical firmware loading, accepting the operational cost of site visits. Additionally, monitor for anomalous POST traffic to the device's update path and for unexpected firmware version changes or reboots, since a successful upload leaves persistent malicious firmware that may not be visible through normal polling and may require device re-flashing to fully remove.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-306, Missing Authentication for Critical Function: the CMU firmware-update handler on the RTU500 series accepts firmware images over a network POST request path without first verifying the caller's identity or authorization. The CPE entry cpe:2.3:a:hitachi_energy:rtu500_series_cmu_firmware:*:*:*:*:*:*:*:* uses a wildcard version, indicating the entire CMU firmware line is treated as affected pending vendor confirmation of fixed builds. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms the endpoint is network-reachable by design with low attack complexity and no privilege or interaction prerequisites. RTU500 hardware is OT/ICS remote terminal unit equipment used in substation and utility automation, so the missing-authentication flaw sits in a subsystem whose integrity and availability characteristics matter more than confidentiality.
Know when Rtu500 Series Cmu Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated remote crafted POST with no user interaction (AV:N/AC:L/PR:N/UI:N); malicious firmware upload yields high integrity and availability impact but no confidentiality (C:N).
Primary rating from Vendor (Hitachi Energy).
CVSS VectorVendor: Hitachi Energy
Lifecycle Timeline
2DescriptionCVE.org
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
Executive ViewAI
Hitachi Energy RTU500 series CMU devices - the communication modules used to connect substation and grid assets to utility control networks - can be taken over by anyone who can reach their firmware-update interface, with no credentials or user interaction required. Because the outcome is unauthorized firmware control rather than data theft, affected utilities face loss of integrity and availability over field equipment that operators rely on for grid monitoring and control, and there is presently no vendor patch to close the gap. Leadership should treat this as an operational continuity and safety-of-service exposure driven by network reachability, not as a data-breach issue.
No vendor patch is available; interim mitigations are network-based and administrative. Restrict or block access to the firmware-update endpoint using firewall rules, ACLs and micro-segmentation so that only authorised engineering workstations on a dedicated management VLAN can reach it; place affected RTU500 CMU devices behind an OT DMZ with no direct internet exposure; disable the firmware-update service if operationally viable; enforce multi-factor authenticated jump-host access for all engineering sessions; monitor for firmware-write and configuration-change events with alerting; verify resident firmware integrity via hash or signature comparison; and maintain offline backups of known-good configurations and firmware images for recovery. Escalate to Hitachi Energy for advisory status, affected versions and a remediation timeline, and apply the vendor patch as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Rtu500 Series Cmu Firmware
View allUnauthenticated network attackers can exploit a directory traversal flaw in the file-upload feature of Hitachi Energy RT
NULL pointer dereference in Hitachi Energy RTU500 series CMU Firmware allows an adjacent low-privileged attacker to cras
The Hitachi Energy RTU500 series CMU web application fails to enforce proper authorization on its reset endpoint, allowi
Denial of service in Hitachi Energy RTU500 Series CMU firmware allows an unauthenticated remote attacker to crash the IE
Exploit-DB