Hitachi Energy RTU500 Product

View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy RTU500 Product are affected: RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/>=13.5.1| =13.6.1| =13.7.1| =13.8.1| =12.7.1|<=12.7.7 (CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6653) CVSS Vendor Equipment v3 8.8 Hitachi Energy RTU500 series CMU Firmware 7 Vulnerabilities NULL Pointer Dereference, Access of Resource Using Incompatible Type ('Type Confusion'), Use After Free, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials, Authentication Bypass by Capture-replay, Authentication Bypass by Primary Weakness Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2026-17539 RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication. Read More 5 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 Additional Metrics Relevant CWE: CWE-476 NULL Pointer Dereference CVSS Version Base Score Base Severity Vector String 3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-28388 A vulnerability exists in OpenSSL library component of RTU500 that is used for secure HTTPS access, authenticating and establishing encrypted communications with other devices. When processing a malformed delta CRL with a Delta CRL Indicator but no required CRL Number extension, OpenSSL may dereference a NULL pointer, causing a Denial of Service during X.509 certificate verification. Exploitation requires delta CRL processing to be enabled, a relevant freshest CRL condition to be present, and an attacker-supplied malformed CRL. The issue is limited to Denial of Service and cannot lead to code execution or memory disclosure. Read