Multiple vulnerabilities affect Hitachi Energy RTU500 series CMU firmware across various versions (12.7.1-12.7.7, 13.5.1-13.5.4, 13.6.1-13.6.2, 13.7.1-13.7.7, 13.8.1). The vulnerabilities include information disclosure through web interface (CVE-2026-1772), denial of service via IEC 60870-5-104 protocol (CVE-2026-1773), stack overflow in libexpat XML parsing (CVE-2024-8176), and resource exhaustion in libexpat (CVE-2025-59375). Successful exploitation can result in exposure of user management information and device outage. The highest CVSS score is 7.5 (High). Firmware updates are available to address all vulnerabilities.