Source: cisa.gov
Hitachi Energy has disclosed two high-severity vulnerabilities affecting its TRO600 series products used in the energy sector. CVE-2026-10756 allows an authenticated attacker to bypass network access restrictions via port forwarding, enabling unauthorized access to localhost-bound services and sensitive functionality. CVE-2026-106087 is an arbitrary file read vulnerability exploitable by unauthenticated attackers, allowing reading or downloading of sensitive configuration files and password data. Both vulnerabilities carry CVSS v3.1 scores of 7.5 (HIGH). Affected versions include TRO600 up to 9.2.1.6 and 9.1.1.0. Fixes are available in versions 9.2.2.1 and 9.1.2.0. CISA recommends minimizing network exposure, isolating control systems behind firewalls, and using VPNs for remote access. The advisory was originally published by Hitachi Energy PSIRT and republished by CISA for increased visibility.
