RTU500 series CMU firmware: Incomplete List of Disallowed Inputs
CVE-2026-1773 is a high-severity incomplete list of disallowed inputs vulnerability in RTU500 series CMU firmware from Hitachi Energy, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected RTU500 series CMU firmware versions: 12.7.1 through 12.7.7; 13.5.1 through 13.5.4; 13.6.1 through 13.6.2, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.45% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Rtu540 Firmware to 13.7.8 or a later version.
- Update Rtu560 Firmware to 13.7.8 or a later version.
- Update Rtu520 Firmware to 13.7.8 or a later version.
- Read the advisory on publisher.hitachienergy.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Hitachi Energy | RTU500 series CMU firmware | 12.7.1 through 12.7.7; 13.5.1 through 13.5.4; 13.6.1 through 13.6.2; 13.7.1 through 13.7.7; 13.8.1 | Not stated |
| Hitachienergy | Rtu540 Firmware | 12.7.1 through 12.7.7; 13.5.1 through 13.5.4; 13.6.1 through 13.6.2; 13.7.1 up to, but not including, 13.7.8; 13.8.1 | 13.7.8 |
| Hitachienergy | Rtu560 Firmware | 12.7.1 through 12.7.7; 13.5.1 through 13.5.4; 13.6.1 through 13.6.2; 13.7.1 up to, but not including, 13.7.8; 13.8.1 | 13.7.8 |
| Hitachienergy | Rtu520 Firmware | 12.7.1 through 12.7.7; 13.5.1 through 13.5.4; 13.6.1 through 13.6.2; 13.7.1 up to, but not including, 13.7.8; 13.8.1 | 13.7.8 |
| Hitachienergy | Rtu530 Firmware | 12.7.1 through 12.7.7; 13.5.1 through 13.5.4; 13.6.1 through 13.6.2; 13.7.1 up to, but not including, 13.7.8; 13.8.1 | 13.7.8 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 4.0 | 8.7 | High | CNA (hitachienergy.com) |
| CVSS 3.1 | 7.5 | High | NVD |
Official description
IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality is configured. Enabling secure communication following IEC 62351-3 does not remediate the vulnerability but mitigates the risk of exploitation.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
How developers prevent this class of flaw
- Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify good input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.
More Incomplete List of Disallowed Inputs vulnerabilities (CWE-184)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Other vulnerabilities in RTU500 series CMU firmware
- 9.1 Critical severity
- 9.1 Critical severity
- 7.2 High severity
- 8.2 High severity
- 7.5 High severity
- 7.5 High severity
Recent Incomplete List of Disallowed Inputs vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 9.8 Critical severity
Spotted an error? Tell us.