Description
A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update,
if secure update feature was not enabled on all
CMUs of a RTU500. If a
malicious actor successfully exploits this vulnerability, they
could use it to update the RTU500 with unsigned firmware.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hitachi Energy | RTU500 series CMU firmware | 13.2.1 – ≤ 13.2.7, 13.4.1 – ≤ 13.4.4, 13.5.1 – ≤ 13.5.3 | — |
Advisories 2
- ICSA-25-023-02 Hitachi Energy RTU500 Series Product (Update B) CISA ICS & IT advisories · Mar 3, 2026
- WID-SEC-2024-0999 Hitachi Energy RTU500: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · May 1, 2024