Multiple Vulnerabilities in Hitachi Energy RTU500 Series Firmware Pose Denial-of-Service Risks
CISA has issued an advisory detailing seven vulnerabilities in Hitachi Energy's RTU500 series CMU Firmware, which could lead to denial-of-service conditions and impact critical infrastructure operations.
CISA has alerted organizations to a series of seven vulnerabilities affecting various versions of Hitachi Energy's RTU500 series CMU Firmware. These flaws, if exploited, could lead to denial-of-service (DoS) conditions, impacting the confidentiality, integrity, and availability of the product, which is widely deployed in critical infrastructure sectors, particularly in energy.
The vulnerabilities span multiple firmware versions, including ranges within 12.7.1 to 12.7.7, 13.5.1 to 13.5.4, 13.6.1 to 13.6.3, 13.7.1 to 13.7.8, and 13.8.1 to 13.8.2. The affected product is crucial for remote terminal units (RTUs) used in energy grids and other industrial control systems, making these vulnerabilities a significant concern for operational stability.
One of the critical vulnerabilities, identified as CVE-2026-17539, involves a NULL pointer dereference within the enhanced message queue. This can occur under high-load scenarios, such as rapid GI requests, leading to a fatal write error in the BCI_IEC104 protocol handler. The consequence is a connection interruption and subsequent device restart, ultimately causing a denial of service for bidirectional IEC 60870-5-104 communication.
Another notable vulnerability, CVE-2026-28388, resides in the OpenSSL library component used for secure HTTPS access and encrypted communications. A malformed delta CRL (Certificate Revocation List) with a Delta CRL Indicator but lacking the required CRL Number extension can trigger a NULL pointer dereference during X.509 certificate verification. While this specific flaw is limited to a denial of service and does not allow for code execution or memory disclosure, it can still disrupt secure communication channels.
Other identified vulnerabilities include Access of Resource Using Incompatible Type ('Type Confusion'), Use After Free, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials, Authentication Bypass by Capture-replay, and Authentication Bypass by Primary Weakness. These collectively contribute to a significant risk profile for the RTU500 product.
Hitachi Energy has acknowledged these vulnerabilities and provided specific remediation guidance. For most affected versions, the recommended fix is to update the CMU Firmware to version 13.9.1. However, for certain firmware branches, interim updates such as 13.7.9 or 13.8.3 are also available. Users are strongly advised to consult the vendor's advisories for precise version-specific instructions and to implement general mitigation factors and workarounds where immediate patching is not feasible.
The overall CVSS v3.1 base score for these vulnerabilities ranges up to a medium severity of 5.9, with specific instances rated as critical due to their potential impact on availability. The widespread deployment of RTU500 devices in global energy infrastructure underscores the importance of prompt patching and security hardening to prevent potential disruptions.