HE
Vendor
Hitachi Energy
25
CVEs
0
On KEV
9
New 30D
Products
RS9.1
RTU500 series CMU firmware
Hitachi Energy
7 CVEs0 on KEV3 new
AS8.5
Asset Suite
Hitachi Energy
3 CVEs0 on KEV2 new
TS8.7
TRO600 Series Firmware
Hitachi Energy
2 CVEs0 on KEV2 new
C47.7
CoreTec 4
Hitachi Energy
1 CVEs0 on KEV1 new
C57.7
CoreTec 5
Hitachi Energy
1 CVEs0 on KEV1 new
MS7.8
MicroSCADA SYS600
Hitachi Energy
3 CVEs0 on KEV0 new
T48.7
TropOS 4th Gen
Hitachi Energy
3 CVEs0 on KEV0 new
RR8.1
Relion REB500
Hitachi Energy
2 CVEs0 on KEV0 new
MH4.4
MACH HiDraw
Hitachi Energy
1 CVEs0 on KEV0 new
PV7.0
PROMOD V
Hitachi Energy
1 CVEs0 on KEV0 new
SU8.8
SuprOS
Hitachi Energy
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106087 New | TS TRO600 Series Firmware Hitachi Energy | 8.7 | Oct 27 | TRO600 contains an arbitrary file read vulnerability |
| CVE-2026-10756 New | TS TRO600 Series Firmware Hitachi Energy | 7.7 | Oct 27 | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost |
| CVE-2026-13162 New | C4 CoreTec 4 Hitachi Energy | 7.7 | Oct 27 | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device |
| CVE-2026-11796 | AS Asset Suite Hitachi Energy | 5.1 | Sep 29 | Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in… |
| CVE-2026-7395 | AS Asset Suite Hitachi Energy | 8.5 | Sep 29 | Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity… |
| CVE-2026-8067 | RS RTU500 series CMU firmware Hitachi Energy | 6.5 | Sep 29 | An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset… |
| CVE-2026-8066 | RS RTU500 series CMU firmware Hitachi Energy | 9.1 | Sep 29 | A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite… |
| CVE-2026-8065 | RS RTU500 series CMU firmware Hitachi Energy | 9.1 | Sep 29 | An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary… |
| CVE-2026-17539 | RS RTU500 series CMU firmware Hitachi Energy | 5.9 | Sep 3 | RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced… |
| CVE-2026-9854 | MS MicroSCADA SYS600 Hitachi Energy | 7.8 | Sep 3 | A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows… |
| CVE-2026-9853 | MS MicroSCADA SYS600 Hitachi Energy | 7.8 | Sep 3 | A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without… |
| CVE-2026-9852 | MS MicroSCADA SYS600 Hitachi Energy | 7.8 | Sep 3 | A CSV injection vulnerability exists in SYS600 |
| CVE-2026-10763 | PV PROMOD V Hitachi Energy | 7.0 | Jun 30 | PROMOD V is using insecure HTTP communication instead of HTTPS |
| CVE-2026-8479 | RS RTU500 series CMU firmware Hitachi Energy | 6.9 | May 26 | IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a certain time,… |
| CVE-2026-7310 | MH MACH HiDraw Hitachi Energy | 4.4 | May 26 | A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw |
| CVE-2026-2460 | RR Relion REB500 Hitachi Energy | 8.1 | Feb 24 | A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not… |
| CVE-2026-2459 | RR Relion REB500 Hitachi Energy | 8.1 | Feb 24 | A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so |
| CVE-2026-1773 | RS RTU500 series CMU firmware Hitachi Energy | 7.5 | Feb 24 | IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality… |
| CVE-2026-1772 | RS RTU500 series CMU firmware Hitachi Energy | 5.3 | Feb 24 | RTU500 web interface: An unprivileged user can read user management information |
| CVE-2025-7740 | SU SuprOS Hitachi Energy | 8.8 | Jan 28 | Use of default credentials vulnerability in Hitachi Energy SuprOS product |
| CVE-2025-1038 | T4 TropOS 4th Gen Hitachi Energy | 7.5 | Oct 28 | The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject… |
| CVE-2025-1037 | T4 TropOS 4th Gen Hitachi Energy | 7.5 | Oct 28 | By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell… |
| CVE-2025-1036 | T4 TropOS 4th Gen Hitachi Energy | 8.7 | Oct 28 | Command injection vulnerability exists in the “Logging” page of the web-based configuration utility |
| CVE-2025-10217 | AS Asset Suite Hitachi Energy | 6.0 | Sep 30 | A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially… |