Vendor
Hitachi Energy
118 known vulnerabilities.
Hitachi Energy at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 3 | 0 |
| Sep 2026 | 9 | 2 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 1 | 0 |
| May 2026 | 2 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 4 | 0 |
| Jan 2026 | 1 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 3 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 7 | 0 |
| May 2025 | 2 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 7 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
FOXMAN-UN 15
UNEM 15
MicroSCADA X SYS600 14
RTU500 series CMU firmware 13
RTU500 7
SDM600 7
MicroSCADA SYS600 6
Asset Suite 5
MicroSCADA Pro SYS600 5
RTU500 series 4
FOX61x 4
TRMTracker 3
TropOS 4th Gen 3
TXpert Hub CoreTec 4 version 3
eSOMS 3
MSM 3
PCM600 2
TRO600 Series Firmware 2
NSD570 Teleprotection Equipment 2
Relion REB500 2
TRO600 2
Relion 670 Series 2
Relion 670/650 Series 2
Relion 670/650/SAM600-IO 2
Relion 650 2
GMS600 2
PWC600 2
MACH System Software 2
XCM20 2
XMC20 2
TXpert Hub CoreTec 4 2
Relion 670/650 and SAM600-IO 2
RTU500 Scripting Interface 1
PCM600 Update Manager 1
FOXCST 1
ECST 1
PROMOD V 1
Asset Suite 9 1
Lumada APM 1
MACH SCM Server 1
Latest advisories
-
High max 7.5
Hitachi Energy RTU500 (Update A)
Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. If exploited, these vulnerabilities primarily impact product availability, with potential secondary impacts on confidentiality and integrity. Please refer …
first May 26, 2026 -
Medium max 7.5
expat: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.
first Mar 13, 2025 -
Medium max 7.5
expat: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.
first Sep 14, 2025 -
High max 7.5
Hitachi Energy MSM Product (Update A)
Hitachi Energy is aware of open-source software vulnerabilities that affect MSM product versions listed in this document below. If exploited these vulnerabilities could result in XSS and DoS attacks potentially causing confidentiality, integrity and availabil…
first Sep 30, 2025 -
Medium max 5.5
Hitachi Energy PCM600 (Update A)
Hitachi Energy is aware of a vulnerability that affects the Hitachi Energy PCM600 product versions listed in this document. An attacker successfully exploiting this vulnerability can impact integrity of the product. Please refer to the Recommended Immediate A…
first Apr 28, 2026
118 results · Feed
-
High 8.7
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to rea…
-
High 7.7
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access …
-
High 7.7
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arb…
-
Medium 5.1
Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServle…
-
High 8.5
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration fil…
-
Medium 6.5
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated…
-
Critical 9.1
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allo…
-
Critical 9.1CVE-2026-8065 Public exploit
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions al…
-
Medium 5.9
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL…
-
High 8.5
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their …
-
High 8.5
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the …
-
Medium 4.6
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, …
-
High 7.0
PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support f…
-
Medium 6.9
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially cra…
-
Medium 4.4
A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious…
-
High 7.6
A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of…
-
High 7.4
A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of dire…
-
High 8.7
IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is o…
-
Medium 5.3
RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via…
-
High 8.8
Use of default credentials vulnerability in Hitachi Energy SuprOS product
Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment.
-
High 7.5
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, a…
-
High 7.5
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user …
-
High 8.7
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated u…
-
Medium 6.0
A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log da…
-
Medium 6.5
A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol …
-
Medium 6.5
A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interfac…
-
Medium 6.5
A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from…
-
High 7.3
A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with l…
-
Medium 6.1
A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker t…
-
High 7.5
A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in…
-
Medium 6.5
An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series devic…
-
High 7.4
A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an…
-
Medium 6.5
A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploite…
-
Medium 6.5
The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code i…
-
Medium 6.1
The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-si…
-
High 7.5
A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotia…
-
Medium 6.1
A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header valu…
-
Medium 6.5
A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that all…
-
Medium 4.9
A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and aut…
-
Medium 4.4
A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU applicat…