Hitachi Energy RTU500

1. Executive summary

Hitachi Energy has published a CISA-republished advisory covering six vulnerabilities in end-of-life RTU500 series CMU firmware versions 11.x and prior, reported to CISA by Dragos. Two of the six carry CVSS 9.1 (CVE-2026-8065, CVE-2026-8066), and two legacy CVEs in the set carry CVSS 9.8 and 10.0 with EPSS scores of 47% and 81% respectively (CVE-2010-2965, CVE-2014-9195). None of the six is listed in CISA KEV, and the affected firmware is no longer maintained, so there is no patch path other than a version upgrade to 12.7.8 or 13.9.1. The RTU500 is a remote terminal unit deployed in energy transmission and distribution, so direct exposure to EMEA financial services is limited to firms with OT dependencies on grid-side telemetry, but the two unauthenticated remote-code and firmware-upload flaws make any internet-reachable or flat-network RTU500 a live integrity risk to the operational data those firms consume.

2. Regulatory framing

No other article in the regulatory reference is directly engaged by this item. The advisory describes vulnerabilities in a product, not an incident at a client, so DORA Art. 17, 18 and 19 and NIS2 Art. 23 incident-reporting obligations are not triggered by the publication itself.

3. Technical analysis & attack chain

The six CVEs affect RTU500 series CMU firmware versions 11.x and prior, all end-of-life. Hitachi Energy states the findings were reported against version 9.x and that versions 11.x and prior are likely affected. Currently supported firmware versions are not affected. The vendor fix for all six is an upgrade to version 12.7.8 or 13.9.1 or later.

Confirmed attack steps, drawn from the vendor descriptions:

1. An attacker reaches the RTU500 firmware update endpoint over the network. CVE-2026-8065 is an authentication bypass in that endpoint: a crafted POST request lets an unauthenticated attacker upload arbitrary firmware. No credentials are required.
2. Separately or in combination, the attacker uses the file upload functionality to write or overwrite arbitrary files on the device file system via directory traversal (CVE-2026-8066, CWE-23 relative path traversal). The vendor does not name the traversal sequence or the upload path.
3. For CVE-2014-9195, an unauthenticated remote attacker sends protocol-compliant network traffic to a network service and executes arbitrary commands. The vendor does not name the protocol or port.
4. For CVE-2010-2965, the WDB target agent debug service in Wind River VxWorks 6.x, 5.x and earlier, present on some legacy RTU500 CMU firmware versions, accepts requests on UDP port 17185 that let a remote attacker read or modify arbitrary memory locations, perform function calls, or manage tasks.
5. CVE-2023-46143 is a download-of-code-without-integrity-check flaw: an unauthenticated remote attacker can modify some or all applications running on the device.
6. CVE-2026-8067 requires an authenticated user and lets that user trigger a reboot through the reset endpoint in the RTU500 web application, causing temporary device unavailability.

Impact across the set is modification of device functionality, loss of integrity or availability, unauthorized modification of device data, or disruption of intended operation. The vendor describes no data exfiltration, no persistence mechanism, no command-and-control channel, and no lateral movement capability. Nothing in the source indicates ransomware or extortion.

Two discrepancies between the verified reference data and the source text are worth recording. The source's summary table quotes CVSS v3 9.8 for the RTU500 CMU firmware set as a whole; the verified per-CVE values are CVSS 9.1 for CVE-2026-8065 and CVE-2026-8066, 6.5 for CVE-2026-8067, 9.8 for CVE-2010-2965 and 10.0 for CVE-2014-9195. Use the per-CVE verified values. The verified data also records CVE-2010-2965 as CWE-863 (Incorrect Authorization) while the source describes it as a missing-authentication flaw in the WDB debug service; both classifications can describe the same service exposure, and the verified CWE is the one to carry into risk registers.

The advisory is a verbatim republication of Hitachi Energy PSIRT 8DBD000251. The vulnerability descriptions, affected versions and remediation are single-sourced to that vendor advisory; the CVSS and EPSS values in this note come from the verified reference data, not from the vendor text.

4. Mitigation & containment

P1 within 24 hours

• Inventory every RTU500 series CMU device and record its firmware version. Any device on 11.x or prior is affected and unsupported. Treat the version check as the first action; without it the rest of this section cannot be scoped.
• Block UDP port 17185 at every boundary that fronts an RTU500. This is the WDB target agent debug service port named in CVE-2010-2965 and it has no operational reason to be reachable from outside the process control network.
• Remove internet reachability from all RTU500 management and firmware update interfaces. CISA's recommended practice for this advisory is to minimize network exposure for control system devices and ensure they are not accessible from the internet.
• Where an RTU500 is reachable from a business network, isolate it behind a firewall with a minimal exposed port set, per the vendor's general mitigation factors.

P2 within 72 hours

• Plan the upgrade to firmware 12.7.8 or 13.9.1 or later. This is the only vendor fix; there is no patch for 11.x and prior. Sequence the upgrade against maintenance windows because the device is a remote terminal unit in a live process.
• Restrict access to the firmware update endpoint and the web application to a named set of management hosts. CVE-2026-8065 needs no credentials, so network reachability is the only control standing in front of it until the upgrade lands.
• Enforce authentication on the web application and review who holds accounts that can reach the reset endpoint, given CVE-2026-8067 lets any authenticated user reboot the device.

P3 within 7 days

• Scan removable media and portable computers before they connect to the control system, per the vendor's general mitigation factors.
• Where remote access to the RTU500 is required, route it through a VPN kept at the most recent version, and treat the VPN as only as strong as the devices behind it.
• Record the firmware version, upgrade date and residual exposure for each device so the third-party and supply chain obligations in §2 have an evidence trail.

5. Indicators of compromise

No indicators of compromise available in the source material. The advisory names no hashes, domains, IP addresses, file paths, registry keys or command lines.

Behavioural indicators, drawn from the vulnerability descriptions:

6. Detection

The source material contains no file hashes, command-line flags, mutex names, scheduled-task names, registry keys or ransom-note text. The only concrete, machine-matchable artefact is the UDP port associated with the WDB target agent debug service. That is a network indicator, so a Sigma rule is the correct form; a YARA rule would have no genuine threat artefact to match on and is not emitted.

title: Inbound Traffic to VxWorks WDB Target Agent Debug Service (UDP 17185)
id: 8f3c1a72-4d5e-4b90-9c21-7a6e2f0b1d44
status: experimental
description: Detects inbound network traffic to UDP port 17185, the WDB target agent debug service port named in CVE-2010-2965 affecting legacy Hitachi Energy RTU500 CMU firmware. The service allows remote memory read/write and function calls without authentication.
author: Adverse Trace
date: 2026-10-06
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06
logsource:
  category: firewall
detection:
  selection:
    dst_port: 17185
    proto: udp
  condition: selection
falsepositives:

  - Authorised engineering or commissioning activity against a VxWorks target on the process control network
level: high
tags:

  - attack.t0836

Deploy the rule at process control network boundaries and on any host firewall fronting an RTU500. Tune against known engineering workstations before enabling blocking.

CVE assessment

5 referenced CVEs — 4 critical (CVSS ≥ 9.0)

7. Sources

• CISA, "Hitachi Energy RTU500", ICSA-26-279-06, published 2026-10-06, https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06
• Hitachi Energy PSIRT 8DBD000251, republished verbatim by CISA within the advisory above, initial release 2026-09-29

8. Adverse Trace position

Adverse Trace assesses this as a high-severity OT advisory with limited direct exposure to EMEA financial services. The two CVSS 9.1 flaws (CVE-2026-8065, CVE-2026-8066) are unauthenticated and remote, and the two legacy CVEs in the set carry EPSS scores of 47% and 81%, but none of the six is in CISA KEV and the affected firmware is end-of-life, which caps the population of exposed devices. The practical risk to a financial services client is indirect: it runs through grid-side telemetry and any OT dependency in the firm's own estate or its critical suppliers. The vulnerability descriptions and remediation are single-sourced to the Hitachi Energy PSIRT advisory, so version and impact claims should be verified against the device itself before enforcement. We will track whether any of the six CVEs is added to CISA KEV, whether Dragos publishes exploitation detail, and whether the RTU500 appears in any sector incident reporting; clients with RTU500 devices in scope should send us their firmware inventory so we can confirm the upgrade path to 12.7.8 or 13.9.1.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.