[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-nine-cves-hit-hitachi-energy-rtu500-grid-firmware":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},11911,"nine-cves-hit-hitachi-energy-rtu500-grid-firmware","Nine CVEs Hit Hitachi Energy RTU500 Grid Firmware","The advisory details three bugs, in the IEC 104 service, OpenSSL and libxml2, and points every affected firmware branch to 13.9.1 or a branch patch.","Hitachi Energy has disclosed nine CVE-listed vulnerabilities in the CMU firmware of its RTU500 series, and every affected version line has a vendor fix or one on the way.\n\nAn RTU, or remote terminal unit, relays readings and commands between field equipment and a control center. The advisory, published October 20, covers CMU firmware 13.5.1 to 13.5.4, 13.6.1 to 13.6.3, 13.7.1 to 13.7.8, 13.8.1 to 13.8.2 and 12.7.1 to 12.7.7. It lists the sector as energy, the deployment as worldwide, and the vendor rates the equipment 8.8 on the CVSS v3 scale, a 10-point severity score. It names seven weakness types, including NULL pointer dereference, type confusion, use after free, cleartext transmission of sensitive information, insufficiently protected credentials and capture-replay authentication bypass.\n\nThree bugs get full descriptions. CVE-2026-17539 sits in the IEC 60870-5-104 service. High-load conditions, such as general interrogation requests sent at short intervals, can trigger a NULL pointer dereference in the last entry of the enhanced message queue. That causes a fatal write error, a connection restart and a denial of service for two-way IEC 104 traffic. It scores 5.9, medium.\n\nCVE-2026-28388 is in OpenSSL, which handles HTTPS access. A malformed delta CRL, a partial certificate revocation list, can crash certificate verification. It needs delta CRL processing enabled, a relevant freshest CRL condition and an attacker-supplied list, and it cannot lead to code execution or memory disclosure. It scores 7.5, high. CVE-2026-6732 is a type confusion error in libxml2, triggered by a crafted XML document in the XML-based services, and it also ends in denial of service.\n\nThe scores differ mainly on attack complexity: high for the IEC 104 bug, low for the OpenSSL one, despite the preconditions in the OpenSSL description. Two of the three flaws also live in open-source libraries, so the device inherits bugs from code Hitachi did not write.\n\nFor operators, the practical path is short. Check which CMU firmware line each unit runs. Version 13.9.1 is the listed fix for all five lines, so 13.x units can go straight there. Units on 12.7 can take 12.7.8 if a jump to 13 is not feasible. The 13.7.9 patch is listed as \"when available\" and 13.8.3 carries an asterisk, so those branches may be better served by 13.9.1. Until a patch lands, Hitachi Energy points to its general mitigation factors and workarounds.","[\"ics\",\"hitachi-energy\",\"vulnerabilities\",\"rtu500\"]","2026-10-20T12:00:00.000Z","2026-10-20T17:02:56.588Z","2026-10-20T17:02:58.153Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the meta-style hedges ('described in detail in the material available', 'the material does not say which CVEs carry them') and replace the closing hedge paragraph with a real conclusion on what operators should do; also drop the unsupported guess that the credential and replay weaknesses explain the 8.8 score, and make the dek clearer that the three detailed bugs are in the IEC 104 service, OpenSSL and libxml2.","resolved","security",[32,33,34,35],"ics","hitachi-energy","vulnerabilities","rtu500",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-293-05",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7043,"2026-10-20T18:00:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1019,"2026-10-20T18:07:34.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",546,"2026-10-20T13:11:23.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",536,"2026-10-20T15:55:20.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",271,"2026-10-20T15:25:03.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",253,"2026-10-20T18:12:50.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",207,"2026-10-20T12:50:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",136,"2026-10-20T16:32:21.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",134,"2026-10-20T14:57:15.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",119,"2026-10-20T13:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",88,"2026-10-20T09:36:16.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",82,"2026-10-20T18:45:39.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":18},"Reviews","reviews",38,{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]