Hitachi Energy TRO600 Vulnerabilities: Affected Firmware and Fixes

What is confirmed as of 2 November 2026

Hitachi Energy published its advisory (PSIRT reference 8DBD000224) on 27 October 2026. CISA republished it on 29 October as ICS advisory ICSA-26-302-02. It covers two vulnerabilities in the TRO600 series firmware: CVE-2026-10756 and CVE-2026-106087. Both are rated High. Hitachi Energy's internal team reported them and no outside researcher is credited.

CVE-2026-106087 is the one most sites will worry about first. An attacker who is not logged in can read or download arbitrary files from the device, including configuration files and password data. CVE-2026-10756 needs a valid login first. An authenticated user can use port forwarding to reach services that are meant to be available only from the device itself (localhost), which could expose sensitive functions and information and affect availability.

The Canadian Centre for Cyber Security published its own notice (AV26-1091) on 27 October listing TRO600 firmware before 9.2.2.1 as affected.

Which TRO600 firmware is affected

The CISA republication of the vendor's CSAF file gives the version picture below. Check each device individually, because estates often run a mixture of firmware lines.

• CVE-2026-10756 (localhost access bypass): TRO600 9.2.1.6 and prior. The CVE record gives the range as 9.0.0.0 through 9.2.1.6. The only fix listed is 9.2.2.1.
• CVE-2026-106087 (unauthenticated file read): TRO600 9.1.1.0 and prior. The CVE record gives the range as 9.0.0.0 through 9.1.1.0. Fixed in 9.1.2.0 for the 9.1 line, and the vendor recommends the latest release, 9.2.2.1.
• Fixed or recommended releases: 9.2.2.1 (recommended) and 9.1.2.0 (file-read fix only, as far as the advisory lists).
• The advisory does not list the 9.2.x line as affected by the file-read flaw. If you are on 9.2.x, treat that as the vendor's statement and confirm it with Hitachi Energy if it matters to your risk decision.

How serious is it

CISA's republication scores both issues 7.5 (High) on CVSS 3.1. The CVE records carry CVSS 4.0 scores: 8.7 for the file read and 7.7 for the localhost bypass. CVSS measures technical severity. It says nothing about whether anyone is attacking you.

Our judgement is that the file read deserves priority because it needs no credentials and the data at stake includes passwords. If a device's management interface was ever reachable from an untrusted network, treat its stored credentials as potentially exposed. The localhost bypass matters more where several people or systems hold logins to the device, since the attacker already needs access.

Neither weakness, as described in the CVE entries, is remote code execution. The advisory's summary does mention that, but the descriptions of the two CVEs only cover access bypass and file read. We have therefore not described either as code execution.

What to do now

These actions are in priority order. Steps 1 to 3 do not change a device. Step 4 does, and TRO600 devices may sit in operational networks, so it belongs under your normal change control.

1. Make a list of every TRO600 device, where it sits and which firmware it runs. Use your asset records or the device's own management interface. If you cannot tell, ask the person or supplier who installed it, or contact Hitachi Energy.
2. Check whether any device management interface can be reached from the internet or from your general office network. Ask your network administrator to check firewall rules. CISA's general advice for these products is to keep control system devices off the internet and behind firewalls, separated from business networks.
3. If remote access is needed, make sure it goes through a VPN that is itself up to date. CISA notes that a VPN is only as secure as the devices connected to it.
4. Schedule the update to 9.2.2.1 for devices on any affected version. If you are on the 9.1 line, 9.1.2.0 closes the file-read flaw, but the advisory lists only 9.2.2.1 as fixing the localhost bypass. Take the exact upgrade procedure, any upgrade path restrictions and downtime expectations from Hitachi Energy's firmware documentation. We have not verified those details and will not guess them. Plan for the device to be unavailable while it updates.
5. After updating, confirm in the device's firmware or version display that it now reports the expected release. Then change administrative credentials and any other secrets stored on the device if there is any chance the file-read flaw was reachable beforehand.

Patching does not undo earlier access

Installing a fixed release closes the holes. It does not tell you whether anyone used them first. If a device was exposed to an untrusted network, review access logs on the device and on the firewalls in front of it for unexpected requests, and rotate passwords as above. CISA also recommends performing impact analysis and risk assessment before deploying defensive measures, which is sensible for equipment that other systems depend on.

Where the sources disagree

Public sources do not agree on every detail, so we have separated what is solid from what needs checking.

The CISA summary lists the fixed versions (9.2.2.1 and 9.1.2.0) next to the affected ones. The fix section and the underlying CSAF file make clear they are the remediated releases. The CISA summary also says the flaws can lead to remote code execution, which the individual CVE descriptions do not support. The Canadian notice says firmware before 9.2.2.1 is affected, a simpler statement than the per-CVE ranges. The lower bound of 9.0.0.0 appears in the CVE records but not in the CISA text, which says only 'and prior'.

We could not retrieve the text of Hitachi Energy's own advisory page in our research, so the version details come from the CISA republication and CVE records. Check the vendor advisory directly before making a final decision for a critical device.

Exploitation and real-world reporting

The CISA advisory does not state that either vulnerability is being exploited, and its SSVC entry records no known exploitation. Neither CVE appeared in CISA's Known Exploited Vulnerabilities catalogue in the aggregator data we checked. The estimated probability of exploitation (EPSS) was under 1 percent when last reported. That is a snapshot and not a promise. We found no public reports of affected organisations and are not naming anyone.