Critical infrastructure operators running Hitachi Energy's RTU500 remote terminal units have a patching job to do.
Seven CVEs were disclosed this week affecting RTU500 CMU firmware across versions 12.7.1 through 13.8.1 — hardware deployed at energy, dam, and water facilities worldwide. The vulnerabilities break into two clusters: a flaw in PKCS#12 certificate handling that crashes the device if a malformed file is uploaded, and five bugs in the libexpat XML parsing library that expose devices using the IEC 61850 industrial protocol to denial-of-service conditions, with the most severe carrying a CVSS score of 7.8. None of the flaws allow remote code execution on their own, but taking an RTU offline mid-operation is a meaningful disruption at a substation or pumping station. Hitachi Energy's fix is firmware version 13.8.2, with 13.7.9 in the pipeline for operators on that branch.
The libexpat cluster is the part worth watching. Libexpat is a decades-old C library that keeps turning up in industrial and embedded systems precisely because it is small and portable — which also means its bugs travel far. Three separate libexpat CVEs from 2025 and 2026 are folded into this single advisory, suggesting Hitachi Energy was carrying an unpatched dependency backlog before this batch landed. That pattern — open-source library bugs accumulating inside closed firmware update cycles — is a recurring problem in operational technology, where vendors ship infrequently and operators update even less often.
The exposure here is theoretically limited because most RTUs sit behind air gaps or segmented OT networks, but "theoretically" is doing a lot of work in an industry where Shodan still finds industrial devices on the public internet every day.