Skip to content
OpenAdvisories
High WID-SEC-2026-3167 9 CVEs

Hitachi Energy RTU500: Mehrere Schwachstellen

Published Sep 2, 2026 · Updated Sep 2, 2026 · de-DE

Vendor: Hitachi Energy Product: RTU500

Summary

Ein Angreifer kann mehrere Schwachstellen in Hitachi Energy RTU500 ausnutzen um Denial-of-Service-Zustände durch Anwendungsabstürze zu verursachen, Cookies oder Authentifizierungsinformationen an unbeabsichtigte Gegenstellen offenzulegen oder vorgesehene Authentifizierungskonfigurationen zu umgehen.

Product

Die RTU500-Serie ist eine Produktfamilie von Remote Terminal Units, die Informationen aus dem physikalischen Stromnetz in ein SCADA-System bringt.

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-11856

    cross-origin Digest auth state leak

    Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authori…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2026-9079

    stale proxy password leak

    libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-8927

    env-set cross-proxy Digest auth state leak

    When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Diges…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-28388

    NULL Pointer Dereference When Processing a Delta CRL

    Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-6276

    stale custom cookie host causes cookie leak

    Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies m…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2026-6653

    libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

    Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

    GNOME libxml2 libxml2 libxml2 Debian Ubuntu
  • Medium 6.5
    CVE-2026-6732

    Libxml2: libxml2: denial of service via crafted xsd-validated document

    A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2026-17539

    RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL…

    Hitachi Energy RTU500 series CMU firmware ICS / OT

Revision history

  1. #1

    Initiale Fassung

References