CVE-2026-8066
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device's intended operation.
Risk Assessment
An unauthenticated attacker can overwrite critical files on the RTU500 device, risking data integrity loss and disruption of control infrastructure. The risk is high because end-of-life devices no longer receive patches.
Recommendation
Isolate RTU500 devices from public networks and restrict access to the file upload interface to trusted management networks only. Plan migration to supported hardware versions, as the end-of-life series will not receive fixes.
Other vulnerabilities in Hitachi Energy RTU500
Original NVD description (English source)
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS