by Kastro
Paper/Archive/CVE-2026-8066

CVE-2026-8066

Hitachi Energy RTU500 series CMU firmware — A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthentica…

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 54.5.545 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.

Affected

ProductAffectedFixed inSource
RTU500 series CMU firmware9.0 – < 12.012.0CNA

Scores by source

Hitachi Energy (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refpublisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch