OTPulse

Hitachi Energy RTU500

Act NowCVSS 9.8ICS-CERT ICSA-26-279-06Sep 29, 2026
Hitachi EnergyEnergyManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Hitachi Energy RTU500 CMU firmware versions 11.x and earlier contain authentication and authorization vulnerabilities (CWE-306, CWE-862, CWE-863) that allow remote attackers to execute commands and modify device configuration without credentials. These end-of-life versions lack modern security controls and hardening measures present in supported versions. The vulnerabilities affect legacy RTU500 firmware but are absent in currently supported firmware versions 12.7.8, 13.9.1, and later. Hitachi Energy recommends immediate upgrade to a supported version and implementation of defense-in-depth security measures.

What this means
What could happen
An attacker on the network could remotely gain full control of an RTU500 CMU (Communication and Metering Unit) without any credentials, allowing them to alter substation settings, disable protection equipment, or disrupt power distribution and monitoring.
Who's at risk
Electric utilities and substations using Hitachi Energy RTU500 CMU devices for power distribution control and monitoring. Affects anyone managing remote terminal units in transmission, distribution, or generation facilities that rely on RTU500 firmware version 11.x or earlier for SCADA communications and protection system coordination.
How it could be exploited
An attacker sends a crafted network request to an RTU500 CMU running firmware version 11.x or earlier. The request exploits missing authentication and authorization checks in the firmware, allowing the attacker to execute commands or modify device configuration remotely over the network without providing any credentials.
Prerequisites
  • Network access to the RTU500 CMU (typically Ethernet port 502 or similar SCADA protocol port)
  • RTU500 CMU firmware version 11.x or earlier installed
remotely exploitableno authentication requiredlow complexityhigh EPSS score (80.7%)affects safety systems
Exploitability
Likely to be exploited — EPSS score 80.7%
Metasploit module available — weaponized exploitView module ↗
Affected products (1)
ProductAffected VersionsFix Status
RTU500 series CMU Firmware≤ 11.x12.7.8 or 13.9.1 or latest
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDDisable remote access to RTU500 CMU management interfaces if not required for operations
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade RTU500 CMU firmware to version 12.7.8 or 13.9.1 or later
Long-term hardening
0/2
HARDENINGImplement network segmentation to restrict access to RTU500 CMU devices from untrusted networks and limit communications to authorized engineering workstations and control center systems
HARDENINGMonitor network traffic to and from RTU500 CMU devices for unauthorized access attempts
View full CISA ICS-CERT advisory
API: /api/v1/advisories/e120da4d-1534-4599-aebe-7fab3c2f2c2f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Hitachi Energy RTU500 | CVSS 9.8 - OTPulse