HE
Vendor
Hitachi Energy
122
CVEs
0
On KEV
4
New 30D
Products
TS8.7
TRO600 Series Firmware
Hitachi Energy
2 CVEs0 on KEV2 new
C47.7
CoreTec 4
Hitachi Energy
1 CVEs0 on KEV1 new
C57.7
CoreTec 5
Hitachi Energy
1 CVEs0 on KEV1 new
RS9.1
RTU500 series CMU firmware
Hitachi Energy
12 CVEs0 on KEV0 new
FO10.0
FOXMAN-UN
Hitachi Energy
10 CVEs0 on KEV0 new
UN10.0
UNEM
Hitachi Energy
10 CVEs0 on KEV0 new
MX8.8
MicroSCADA X SYS600
Hitachi Energy
8 CVEs0 on KEV0 new
RT7.5
RTU500
Hitachi Energy
7 CVEs0 on KEV0 new
SD9.1
SDM600
Hitachi Energy
7 CVEs0 on KEV0 new
MS9.8
MicroSCADA SYS600
Hitachi Energy
6 CVEs0 on KEV0 new
AS8.5
Asset Suite
Hitachi Energy
5 CVEs0 on KEV0 new
ES5.3
eSOMS
Hitachi Energy
3 CVEs0 on KEV0 new
RS7.5
RTU500 series
Hitachi Energy
3 CVEs0 on KEV0 new
TR6.5
TRMTracker
Hitachi Energy
3 CVEs0 on KEV0 new
T48.7
TropOS 4th Gen
Hitachi Energy
3 CVEs0 on KEV0 new
FO6.9
FOX61x
Hitachi Energy
2 CVEs0 on KEV0 new
MS6.5
MACH System Software
Hitachi Energy
2 CVEs0 on KEV0 new
MP8.8
MicroSCADA Pro SYS600
Hitachi Energy
2 CVEs0 on KEV0 new
NT5.3
NSD570 Teleprotection Equipment
Hitachi Energy
2 CVEs0 on KEV0 new
R67.5
Relion 670/650 and SAM600-IO
Hitachi Energy
2 CVEs0 on KEV0 new
RR8.1
Relion REB500
Hitachi Energy
2 CVEs0 on KEV0 new
TR7.2
TRO600
Hitachi Energy
2 CVEs0 on KEV0 new
TH8.0
TXpert Hub CoreTec 4
Hitachi Energy
2 CVEs0 on KEV0 new
XM6.9
XMC20
Hitachi Energy
2 CVEs0 on KEV0 new
AS8.8
Asset Suite 9
Hitachi Energy
1 CVEs0 on KEV0 new
AS5.3
Asset Suite EAM
Hitachi Energy
1 CVEs0 on KEV0 new
EC6.8
ECST
Hitachi Energy
1 CVEs0 on KEV0 new
FT7.5
FOX61x TEGO1
Hitachi Energy
1 CVEs0 on KEV0 new
FO6.8
FOXCST
Hitachi Energy
1 CVEs0 on KEV0 new
GM7.5
GMS600
Hitachi Energy
1 CVEs0 on KEV0 new
IS7.5
ITT600 SA Explorer
Hitachi Energy
1 CVEs0 on KEV0 new
MH4.4
MACH HiDraw
Hitachi Energy
1 CVEs0 on KEV0 new
MS7.5
MACH SCM
Hitachi Energy
1 CVEs0 on KEV0 new
MS7.5
MACH SCM Server
Hitachi Energy
1 CVEs0 on KEV0 new
MS7.5
MACH SCM Tools
Hitachi Energy
1 CVEs0 on KEV0 new
MS7.5
MSM
Hitachi Energy
1 CVEs0 on KEV0 new
PV7.0
PROMOD V
Hitachi Energy
1 CVEs0 on KEV0 new
PW7.5
PWC600
Hitachi Energy
1 CVEs0 on KEV0 new
RE7.5
REB500
Hitachi Energy
1 CVEs0 on KEV0 new
R67.5
Relion® 650
Hitachi Energy
1 CVEs0 on KEV0 new
R67.5
Relion® 670
Hitachi Energy
1 CVEs0 on KEV0 new
R64.5
Relion 670/650/SAM600-IO Series
Hitachi Energy
1 CVEs0 on KEV0 new
RE7.5
Relion670
Hitachi Energy
1 CVEs0 on KEV0 new
RS7.5
RTU500 Scripting Interface
Hitachi Energy
1 CVEs0 on KEV0 new
SA7.5
SAM600-IO
Hitachi Energy
1 CVEs0 on KEV0 new
SU8.8
SuprOS
Hitachi Energy
1 CVEs0 on KEV0 new
TH7.5
TXpert Hub CoreTec 5
Hitachi Energy
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106087 New | TS TRO600 Series Firmware Hitachi Energy | 8.7 | Oct 27 | TRO600 contains an arbitrary file read vulnerability |
| CVE-2026-10756 New | TS TRO600 Series Firmware Hitachi Energy | 7.7 | Oct 27 | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost |
| CVE-2026-13162 New | C4 CoreTec 4 Hitachi Energy | 7.7 | Oct 27 | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device |
| CVE-2026-11796 | AS Asset Suite Hitachi Energy | 5.1 | Sep 29 | Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in… |
| CVE-2026-7395 | AS Asset Suite Hitachi Energy | 8.5 | Sep 29 | Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity… |
| CVE-2026-8067 | RS RTU500 series CMU firmware Hitachi Energy | 6.5 | Sep 29 | An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset… |
| CVE-2026-8066 | RS RTU500 series CMU firmware Hitachi Energy | 9.1 | Sep 29 | A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite… |
| CVE-2026-8065 | RS RTU500 series CMU firmware Hitachi Energy | 9.1 | Sep 29 | An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary… |
| CVE-2026-17539 | RS RTU500 series CMU firmware Hitachi Energy | 5.9 | Sep 3 | RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced… |
| CVE-2026-9854 | MS MicroSCADA SYS600 Hitachi Energy | 7.8 | Sep 3 | A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows… |
| CVE-2026-9853 | MS MicroSCADA SYS600 Hitachi Energy | 7.8 | Sep 3 | A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without… |
| CVE-2026-9852 | MS MicroSCADA SYS600 Hitachi Energy | 7.8 | Sep 3 | A CSV injection vulnerability exists in SYS600 |
| CVE-2026-10763 | PV PROMOD V Hitachi Energy | 7.0 | Jun 30 | PROMOD V is using insecure HTTP communication instead of HTTPS |
| CVE-2026-8479 | RS RTU500 series CMU firmware Hitachi Energy | 6.9 | May 26 | IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a certain time,… |
| CVE-2026-7310 | MH MACH HiDraw Hitachi Energy | 4.4 | May 26 | A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw |
| CVE-2026-2460 | RR Relion REB500 Hitachi Energy | 8.1 | Feb 24 | A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not… |
| CVE-2026-2459 | RR Relion REB500 Hitachi Energy | 8.1 | Feb 24 | A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so |
| CVE-2026-1773 | RS RTU500 series CMU firmware Hitachi Energy | 7.5 | Feb 24 | IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality… |
| CVE-2026-1772 | RS RTU500 series CMU firmware Hitachi Energy | 5.3 | Feb 24 | RTU500 web interface: An unprivileged user can read user management information |
| CVE-2025-7740 | SU SuprOS Hitachi Energy | 8.8 | Jan 28 | Use of default credentials vulnerability in Hitachi Energy SuprOS product |
| CVE-2025-1038 | T4 TropOS 4th Gen Hitachi Energy | 7.5 | Oct 28 | The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject… |
| CVE-2025-1037 | T4 TropOS 4th Gen Hitachi Energy | 7.5 | Oct 28 | By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell… |
| CVE-2025-1036 | T4 TropOS 4th Gen Hitachi Energy | 8.7 | Oct 28 | Command injection vulnerability exists in the “Logging” page of the web-based configuration utility |
| CVE-2025-10217 | AS Asset Suite Hitachi Energy | 6.0 | Sep 30 | A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially… |
| CVE-2025-39205 | MX MicroSCADA X SYS600 Hitachi Energy | 6.5 | Jun 24 | A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product |
| CVE-2025-39204 | MX MicroSCADA X SYS600 Hitachi Energy | 6.5 | Jun 24 | A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product |
| CVE-2025-39203 | MX MicroSCADA X SYS600 Hitachi Energy | 6.5 | Jun 24 | A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product |
| CVE-2025-39202 | MX MicroSCADA X SYS600 Hitachi Energy | 8.1 | Jun 24 | A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product |
| CVE-2025-39201 | MX MicroSCADA X SYS600 Hitachi Energy | 6.1 | Jun 24 | A vulnerability exists in MicroSCADA X SYS600 product |
| CVE-2025-2403 | R6 Relion 670/650 and SAM600-IO Hitachi Energy | 7.5 | Jun 24 | A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SAM600-IO series device that if… |
| CVE-2025-1718 | R6 Relion 670/650 and SAM600-IO Hitachi Energy | 6.5 | Jun 24 | An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to improper disk space management |
| CVE-2025-2500 | AS Asset Suite Hitachi Energy | 7.4 | May 30 | A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below |
| CVE-2025-1484 | AS Asset Suite Hitachi Energy | 6.5 | May 30 | A vulnerability exists in the media upload component of the Asset Suite versions listed below |
| CVE-2025-27631 | TR TRMTracker Hitachi Energy | 6.5 | Mar 25 | The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and… |
| CVE-2025-27633 | TR TRMTracker Hitachi Energy | 6.1 | Mar 25 | The TRMTracker web application is vulnerable to reflected Cross-site scripting attack |
| CVE-2025-1445 | RT RTU500 Hitachi Energy | 7.5 | Mar 25 | A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in… |
| CVE-2025-27632 | TR TRMTracker Hitachi Energy | 6.1 | Mar 25 | A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors,… |
| CVE-2024-12169 | RT RTU500 Hitachi Energy | 6.5 | Mar 25 | A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to… |
| CVE-2024-11499 | RT RTU500 Hitachi Energy | 4.9 | Mar 25 | A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a CMU restart |
| CVE-2024-10037 | RT RTU500 Hitachi Energy | 4.4 | Mar 25 | A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a… |
| CVE-2024-9929 | NT NSD570 Teleprotection Equipment Hitachi Energy | 4.3 | Nov 26 | A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps |
| CVE-2024-9928 | NT NSD570 Teleprotection Equipment Hitachi Energy | 5.3 | Nov 26 | A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts |
| CVE-2024-41156 | TR TRO600 Hitachi Energy | 2.7 | Oct 29 | Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats |
| CVE-2024-41153 | TR TRO600 Hitachi Energy | 7.2 | Oct 29 | Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands |
| CVE-2024-7941 | MS MicroSCADA SYS600 Hitachi Energy | 4.3 | Aug 27 | An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL |
| CVE-2024-7940 | MS MicroSCADA SYS600 Hitachi Energy | 9.8 | Aug 27 | The product exposes a service that is intended for local only to all network interfaces without any authentication |
| CVE-2024-3982 | MS MicroSCADA SYS600 Hitachi Energy | 8.2 | Aug 27 | An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of… |
| CVE-2024-3980 | MX MicroSCADA X SYS600 Hitachi Energy | 8.8 | Aug 27 | The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations |
| CVE-2024-4872 | MP MicroSCADA Pro SYS600 Hitachi Energy | 8.8 | Aug 27 | A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product |
| CVE-2024-28020 | UN UNEM Hitachi Energy | 8.0 | Jun 11 | A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management |
| CVE-2024-28024 | UN UNEM Hitachi Energy | 4.1 | Jun 11 | A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another control sphere |
| CVE-2024-28022 | UN UNEM Hitachi Energy | 6.5 | Jun 11 | A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different… |
| CVE-2024-28023 | UN UNEM Hitachi Energy | 5.7 | Jun 11 | A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintended actors, possibly providing… |
| CVE-2024-28021 | UN UNEM Hitachi Energy | 7.4 | Jun 11 | A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation |
| CVE-2024-2011 | FO FOXMAN-UN Hitachi Energy | 9.8 | Jun 11 | A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code,… |
| CVE-2024-2012 | FO FOXMAN-UN Hitachi Energy | 9.8 | Jun 11 | vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server… |
| CVE-2024-2013 | UN UNEM Hitachi Energy | 10.0 | Jun 11 | An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the… |
| CVE-2024-2461 | XM XMC20 Hitachi Energy | 6.9 | Jun 11 | If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible |
| CVE-2024-2462 | FO FOXCST Hitachi Energy | 6.8 | Jun 11 | Allow attackers to intercept or falsify data exchanges between the client and the server |
| CVE-2024-2378 | SD SDM600 Hitachi Energy | 8.0 | Apr 30 | A vulnerability exists in the web-authentication component of the SDM600 |