Hitachi Energy RTU500 EUVD-2026-88686

Requires an authenticated low-privilege account or active session on the RTU500 web application (PR:L), plus network reachability to that web management interface. The vulnerable behavior is the web application's reset endpoint, which fails to enforce proper authorization (CWE-862) so a user without reboot rights can trigger it. Limiting factors: valid credentials/session are mandatory (no unauthenticated path), the web interface must be network-accessible to the attacker, and the impact is a temporary, recoverable reboot rather than persistent damage or data exposure. Exposure is highest where the RTU500 management interface is reachable from broader IT/OT networks rather than an isolated management VLAN.

This is a genuine but moderate-severity availability issue, not a high-priority emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: an authenticated (PR:L) user reaches the web application's reset endpoint over the network (AV:N) with low complexity (AC:L) and no user interaction, causing an availability-only impact (A:H) with no confidentiality or integrity loss. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation is speculative - there is no evidence of active exploitation or weaponization. The key mitigating signal is PR:L: an attacker must already possess valid credentials or a session on the RTU500 web interface, which limits this to insiders or attackers who have already gained a foothold. The real-world weight comes from context, not the number: the RTU500 is an OT/ICS remote terminal unit used in electric-utility substation automation, where an unexpected reboot can disrupt grid telemetry and control, so the A:H rating is meaningful operationally even though the flaw is only a recoverable DoS. Overall: real but not urgent - prioritize based on exposure of the management interface and credential hygiene rather than fear of mass exploitation.

An attacker who has obtained low-privilege credentials to the RTU500 web application (or an insider) sends a request to the device's reset endpoint that lacks a proper authorization check. The device reboots, causing temporary unavailability of substation telemetry and control until it comes back online. No public exploit code is identified at time of analysis, and the low attack complexity means the request is trivial to repeat for sustained disruption.