Multiple security vulnerabilities have been identified in Hitachi Energy TRO600 series products, affecting versions 9.2.1.6 and prior and 9.1.1.0 and prior. The issues can allow remote code execution, unauthorized access to sensitive functionality, and disclosure of confidential information, creating a high risk to industrial control environments. These weaknesses affect energy-sector control systems and may enable further attacks once initial access is obtained.
CVE-2026-10756 (CVSS 7.5 — High): This flaw in TRO600 allows an authenticated attacker to bypass network access restrictions and reach services that are intended to be available only on the local device. By leveraging port forwarding, the attacker can interact with locally bound services, leading to unauthorized access to sensitive functionality and confidential information, along with availability impact.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Hitachi Energy TRO600 series products, affecting versions 9.2.1.6 and prior and 9.1.1.0 and prior. The issues can allow remote code execution, unauthorized access to sensitive functionality, and disclosure of confidential information, creating a high risk to industrial control environments. These weaknesses affect energy-sector control systems and may enable further attacks once initial access is obtained.
CVE-2026-10756 (CVSS 7.5 — High): This flaw in TRO600 allows an authenticated attacker to bypass network access restrictions and reach services that are intended to be available only on the local device. By leveraging port forwarding, the attacker can interact with locally bound services, leading to unauthorized access to sensitive functionality and confidential information, along with availability impact.[emaillocker id="1283"]
CVE-2026-106087 (CVSS 7.5 — High): This is an arbitrary file read vulnerability in TRO600 that can be exploited by an unauthenticated attacker. The attacker can read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in disclosure of sensitive information.
These vulnerabilities collectively present a significant risk to organizations operating affected industrial control equipment, particularly where the product is reachable from untrusted networks. Defenders should focus on reducing exposure and detecting unauthorized access to limit the potential impact.
We recommend you to update TRO600 Series Firmware to version 9.1.2.0 or 9.2.2.1.
The following reports contain further technical details:
[/emaillocker]