Summary
Ein Angreifer kann mehrere Schwachstellen in Hitachi Energy RTU500 ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, die Gerätefunktionalität zu verändern oder Denial-of-Service-Zustände zu verursachen.
Product
Die RTU500-Serie ist eine Produktfamilie von Remote Terminal Units, die Informationen aus dem physikalischen Stromnetz in ein SCADA-System bringt.
Vulnerabilities 6
-
Critical 10.0
Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
-
Critical 9.8CVE-2010-2965 EPSS 58%
The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756…
-
Critical 9.1CVE-2026-8065 Public exploit
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions al…
-
Critical 9.1
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allo…
-
High 7.5
Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.
-
Medium 6.5
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated…
Revision history
-
#1
Initiale Fassung
References
-
Hitachi Energy Security Advisory vom 2026-09-29
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch