Hitachi Energy TRO600 Series Products Vulnerable to RCE and Data Disclosure
CISA has identified two critical vulnerabilities in Hitachi Energy's TRO600 series industrial control system products, potentially allowing remote code execution and sensitive data exfiltration.
Hitachi Energy's TRO600 series industrial control system products are facing significant security risks due to two newly disclosed vulnerabilities, CVE-2026-10756 and CVE-2026-106087. These flaws, detailed in a recent CISA advisory, could enable attackers to achieve remote code execution (RCE) and gain unauthorized access to sensitive information, posing a threat to critical infrastructure operations.
CVE-2026-10756, classified as an "Improper Restriction of Communication Channel to Intended Endpoints" vulnerability, allows an authenticated attacker to bypass network access controls. By exploiting port forwarding mechanisms, an attacker can interact with services bound only to localhost, leading to the disclosure of confidential data and potential availability impacts. This vulnerability has a CVSS v3.1 score of 7.5 (High).
The second vulnerability, CVE-2026-106087, is an "Arbitrary File Read" flaw. This issue permits unauthenticated attackers to read or download any file from the affected device. This could include critical configuration files and stored password data, resulting in a significant disclosure of sensitive information. This vulnerability also carries a CVSS v3.1 score of 7.5 (High).
These vulnerabilities affect specific versions of the TRO600 series, including versions 9.2.1.6 and prior for CVE-2026-10756, and versions 9.1.1.0 and prior for CVE-2026-106087. Hitachi Energy has released patches, recommending updates to version 9.2.2.1 for the affected products. Users are urged to apply these updates promptly to mitigate the risks.
Hitachi Energy has acknowledged these vulnerabilities and provided specific remediation guidance. The company recommends updating to version 9.2.2.1 for TRO600 series products to address CVE-2026-10756. For CVE-2026-106087, updates to version 9.1.2.0 or the latest version 9.2.2.1 are advised.
CISA emphasizes that organizations should implement defensive measures to minimize the risk of exploitation. These include minimizing network exposure of control system devices, ensuring they are not accessible from the internet, and isolating control system networks behind firewalls. Secure remote access methods like VPNs should be used when necessary, with the understanding that VPNs themselves require up-to-date security.
The disclosure of these vulnerabilities highlights the ongoing security challenges within the industrial control systems (ICS) sector. The ability for attackers to gain RCE and access sensitive data on critical infrastructure components like Hitachi Energy's TRO600 series underscores the need for continuous vigilance, prompt patching, and robust network segmentation to protect these vital systems.