Hitachi Energy RTU500 Product

CISA published an ICS advisory regarding multiple vulnerabilities affecting Hitachi Energy RTU500 series CMU Firmware versions 12.7.1-12.7.7, 13.5.1-13.5.4, 13.6.1-13.6.3, 13.7.1-13.7.8, and 13.8.1-13.8.2. Seven distinct vulnerability types were identified including NULL Pointer Dereference, Type Confusion, Use After Free, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials, Authentication Bypass by Capture-replay, and Authentication Bypass by Primary Weakness. The vulnerabilities affect the energy critical infrastructure sector and are deployed worldwide. CVSS scores range from 5.3 (Medium) to 8.8 (High), with the highest severity being CVE-2026-6653 (Use After Free in libxml2) at CVSS 8.8. Affected libraries include OpenSSL, libxml2, and libcurl components embedded in the RTU500 firmware. Remediation involves updating to CMU Firmware version 13.9.1 as the primary fix, with version-specific patches also available (12.7.8, 13.7.9, 13.8.3). General mitigations include network isolation, firewall segmentation, and avoiding direct internet exposure of control system devices. The vulnerabilities were reported by Hitachi Energy's internal security team.