Hitachi Energy vulnerabilities
We track 58 vulnerabilities in Hitachi Energy products across 36 products. 58 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Hitachi Energy vulnerabilities
- 7.7 High severity
CoreTec 5: Improper Neutralization of Special Elements used in an OS Command
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler
- 7.7 High severity
TRO600 Series Firmware: Improper Restriction of Communication Channel to Intended Endpoints
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and s
- 8.7 High severity
TRO600 Series Firmware: Missing Authentication for Critical Functionality
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure
- 9.1 Critical severity
RTU500 series CMU firmware: Relative Path Traversal
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful e
- 9.1 Critical severity
RTU500 series CMU firmware: Missing Authentication for Critical Functionality
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacke
- 8.5 High severity
Asset Suite: Missing Authentication for Critical Functionality
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing pur
- 7.8 High severity
MicroSCADA SYS600: Incorrect Implementation of Authentication Algorithm
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
- 7.8 High severity
MicroSCADA SYS600: Incorrect Implementation of Authentication Algorithm
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users shou
- 7.8 High severity
MicroSCADA SYS600: Improper Neutralization of Formula Elements in a CSV File
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the u
- 8.1 High severity
Relion REB500: Privilege Defined With Unsafe Actions
A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not authorized to do so.
- 8.1 High severity
Relion REB500: Privilege Defined With Unsafe Actions
A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.
- 7.5 High severity
RTU500 series CMU firmware: Incomplete List of Disallowed Inputs
IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality is configured. Enabling secure communication following IEC 62351-3 does not reme
- 8.8 High severity
SuprOS: Use of Default Credentials
Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment.
- 7.5 High severity
TropOS 4th Gen: Improper Neutralization of Special Elements used in an OS Command
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected comma
- 7.5 High severity
TropOS 4th Gen: Improper Privilege Management
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a particular s
- 8.7 High severity
TropOS 4th Gen: Improper Neutralization of Special Elements used in an OS Command
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH a
- 8.1 High severity
MicroSCADA X SYS600: Improper Privilege Management
A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corruption.
- 7.5 High severity
Relion 670/650 and SAM600-IO: Allocation of Resources Without Limits or Throttling
A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SAM600-IO series device that if exploited could potentially cause critical functions like LDCM (Line Distance Communicati
- 7.4 High severity
Asset Suite: Plaintext Storage of a Password
A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gain unauthorized access to the product and the time window of a possible password attack could be expanded.
- 7.5 High severity
RTU500: Missing Synchronization
A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations, when IEC61850 communication is active. Precondition is tha
- 7.2 High severity
TRO600: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges,
- 8.8 High severity
MicroSCADA X SYS600: Improper Neutralization of Special Elements in Data Query Logic
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability an attacker must have a
- 8.2 High severity
MicroSCADA SYS600: Authentication Bypass by Capture-replay
An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enab
- 8.8 High severity
MicroSCADA X SYS600: Improper Limitation of a Pathname to a Restricted Directory
The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that a
- 8.0 High severity
FOXMAN-UN: Incorrect User Management
A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login information through complex routines to extend access on the server and other se
- 10.0 Critical severity
FOXMAN-UN: Missing Authentication for Critical Functionality
An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the services and the post-authentication attack surface.
- 9.8 Critical severity
FOXMAN-UN: Authentication Bypass Using an Alternate Path or Channel
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allowing sensitive data to be read or modified or could cause other unintended behavi
- 9.8 Critical severity
FOXMAN-UN: Out-of-bounds Write
A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy
- 7.4 High severity
FOXMAN-UN: Improper Certificate Validation
A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an attacker could spoof a trusted entity causing a loss of confidentiality and integrity.
- 7.2 High severity
RTU500 series CMU firmware: Improperly Implemented Security Check for Standard
A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update, if secure update feature was not enabled on all CMUs of a RTU500. If a malicious actor successfully exploits this vulnerability, they could use it
- 8.0 High severity
SDM600: Incorrect Authorization
A vulnerability exists in the web-authentication component of the SDM600. If exploited an attacker could escalate privileges on af-fected installations.
- 7.6 High severity
SDM600: Origin Validation Error
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information.
- 7.5 High severity
MACH SCM Server: Improper Control of Generation of Code
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Too
- 7.5 High severity
MACH SCM: Improper Control of Generation of Code
SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An Authenticated malicious client can send a specially crafted code to skip the validation and execute a
- 8.2 High severity
RTU500 series CMU firmware: Unrestricted Upload of File with Dangerous Type
A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could print random memory content in the RTU500 system log, if an authorized user uploads a specially crafted stb-language
- 7.5 High severity
RTU500 series CMU firmware: Out-of-bounds Write
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rat
- 7.5 High severity
RTU500 series CMU Firmware: Buffer Copy without Checking Size of Input
Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as fi
- 7.5 High severity
RTU500 Scripting Interface: Improper Certificate Validation
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (
- 7.5 High severity
Relion670: Improper Validation of Specified Quantity in Input
A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured.
- 8.8 High severity
Asset Suite 9: Improper Authentication
A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Rel