CVE-2026-8065
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
Risk Assessment
An attacker can upload custom firmware to the RTU500 device without authentication, taking control of its operation. This could lead to permanent damage or shutdown of the device in industrial infrastructure.
Recommendation
Immediately block network access to the firmware update endpoint on RTU500 devices and enforce network-level access control. Plan replacement of end-of-life devices with supported models.
Other vulnerabilities in Hitachi Energy RTU500
Original NVD description (English source)
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS