CVE-2026-8065

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

Score

CVSS 3.1 9.1 Critical

Status

Awaiting Analysis - cybersecurity@hitachienergy.com

Published

2026-09-29

Last modified

2026-09-29

Weaknesses

CWE-306

Affected products

• Rtu500 Series Cmu Firmware (Hitachi Energy)

References

• https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch