Hitachi Energy has disclosed nine CVE-listed vulnerabilities in the CMU firmware of its RTU500 series, and every affected version line has a vendor fix or one on the way.
An RTU, or remote terminal unit, relays readings and commands between field equipment and a control center. The advisory, published October 20, covers CMU firmware 13.5.1 to 13.5.4, 13.6.1 to 13.6.3, 13.7.1 to 13.7.8, 13.8.1 to 13.8.2 and 12.7.1 to 12.7.7. It lists the sector as energy, the deployment as worldwide, and the vendor rates the equipment 8.8 on the CVSS v3 scale, a 10-point severity score. It names seven weakness types, including NULL pointer dereference, type confusion, use after free, cleartext transmission of sensitive information, insufficiently protected credentials and capture-replay authentication bypass.
Three bugs get full descriptions. CVE-2026-17539 sits in the IEC 60870-5-104 service. High-load conditions, such as general interrogation requests sent at short intervals, can trigger a NULL pointer dereference in the last entry of the enhanced message queue. That causes a fatal write error, a connection restart and a denial of service for two-way IEC 104 traffic. It scores 5.9, medium.
CVE-2026-28388 is in OpenSSL, which handles HTTPS access. A malformed delta CRL, a partial certificate revocation list, can crash certificate verification. It needs delta CRL processing enabled, a relevant freshest CRL condition and an attacker-supplied list, and it cannot lead to code execution or memory disclosure. It scores 7.5, high. CVE-2026-6732 is a type confusion error in libxml2, triggered by a crafted XML document in the XML-based services, and it also ends in denial of service.
The scores differ mainly on attack complexity: high for the IEC 104 bug, low for the OpenSSL one, despite the preconditions in the OpenSSL description. Two of the three flaws also live in open-source libraries, so the device inherits bugs from code Hitachi did not write.
For operators, the practical path is short. Check which CMU firmware line each unit runs. Version 13.9.1 is the listed fix for all five lines, so 13.x units can go straight there. Units on 12.7 can take 12.7.8 if a jump to 13 is not feasible. The 13.7.9 patch is listed as "when available" and 13.8.3 carries an asterisk, so those branches may be better served by 13.9.1. Until a patch lands, Hitachi Energy points to its general mitigation factors and workarounds.