--- title: "Hitachi Energy RTU500 series CMU firmware vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/hitachi-energy/rtu500-series-cmu-firmware type: product description: "Hitachi Energy RTU500 series CMU firmware has 13 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-09-29 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Hitachi Energy RTU500 series CMU firmware vulnerabilities Vendor: [Hitachi Energy](https://radicalnotion.ai/vendor/hitachi-energy) - **Published CVEs:** 13 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 7 - **Average CVSS:** 7.4 - **First CVE:** 2022-05-02 - **Latest CVE:** 2026-09-29 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 2 | | High | 6 | | Medium | 5 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 2 | | [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 2 | | [CWE-184](https://radicalnotion.ai/cwe/cwe-184) | Incomplete List of Disallowed Inputs | 1 | | [CWE-23](https://radicalnotion.ai/cwe/cwe-23) | Relative Path Traversal | 1 | | [CWE-280](https://radicalnotion.ai/cwe/cwe-280) | Improper Handling of Insufficient Permissions or Privileges | 1 | | [CWE-306](https://radicalnotion.ai/cwe/cwe-306) | Missing Authentication for Critical Function | 1 | | [CWE-358](https://radicalnotion.ai/cwe/cwe-358) | Improperly Implemented Security Check for Standard | 1 | | [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2022 | 1 | | 2023 | 1 | | 2024 | 4 | | 2025 | 0 | | 2026 | 7 | ## Affected versions (top 19 of 34) | Version | Kind | CVEs | | --- | --- | --- | | 12.0.\* | exact | 1 | | 12.2.\* | exact | 1 | | 12.4.\* | exact | 1 | | 12.6.\* | exact | 1 | | 12.7.\* | exact | 1 | | 13.2.\* | exact | 1 | | 12.7.1 \<= v \<= 12.7.7 | range | 4 | | 13.5.1 \<= v \<= 13.5.4 | range | 4 | | \>= 13.8.1 | range | 3 | | 12.0.1 \<= v \<= 12.0.14 | range | 3 | | 12.2.1 \<= v \<= 12.2.11 | range | 3 | | 12.4.1 \<= v \<= 12.4.11 | range | 3 | | 12.6.1 \<= v \<= 12.6.9 | range | 3 | | 12.7.1 \<= v \<= 12.7.6 | range | 3 | | 13.2.1 \<= v \<= 13.2.6 | range | 3 | | 13.4.1 \<= v \<= 13.4.4 | range | 3 | | 13.5.1 \<= v \<= 13.5.3 | range | 3 | | 9.0 \<= v \< 12.0 | range | 3 | | 12.0 | patched | 3 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-8067 | - | medium | 6.5 | No | No | Yes | | CVE-2026-8066 | - | critical | 9.1 | No | No | Yes | | CVE-2026-8065 | - | critical | 9.1 | No | No | Yes | | CVE-2026-17539 | - | medium | 5.9 | No | No | No | | CVE-2026-8479 | - | medium | 6.9 | No | No | No | | CVE-2026-1773 | - | high | 8.7 | No | No | Yes | | CVE-2026-1772 | - | medium | 5.3 | No | No | Yes | | CVE-2024-2617 | - | high | 7.2 | No | No | No | | CVE-2024-1532 | - | medium | 6.8 | No | No | No | | CVE-2024-1531 | - | high | 8.2 | No | No | No | | CVE-2022-2081 | - | high | 7.5 | No | No | No | | CVE-2023-6711 | - | high | 7.5 | No | No | Yes | | CVE-2022-28613 | Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series | high | 7.5 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Hitachi Energy RTU500 series CMU firmware have? Hitachi Energy RTU500 series CMU firmware has 13 published CVE records since 2022. ### How many Hitachi Energy RTU500 series CMU firmware CVEs are in CISA KEV? None of Hitachi Energy RTU500 series CMU firmware's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Hitachi Energy RTU500 series CMU firmware vulnerabilities? No Hitachi Energy RTU500 series CMU firmware CVEs currently have a tracked public exploit in this dataset. ### Which versions of Hitachi Energy RTU500 series CMU firmware are affected? 34 distinct Hitachi Energy RTU500 series CMU firmware versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Hitachi Energy RTU500 series CMU firmware CVEs? Hitachi Energy RTU500 series CMU firmware's CVEs most often map to these CWE weakness types: CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-476 (NULL Pointer Dereference), CWE-184 (Incomplete List of Disallowed Inputs), CWE-23 (Relative Path Traversal). ### How many critical Hitachi Energy RTU500 series CMU firmware vulnerabilities are there? Hitachi Energy RTU500 series CMU firmware has 2 critical and 6 high-severity CVEs. ### What is the average severity of Hitachi Energy RTU500 series CMU firmware CVEs? The average CVSS base score across Hitachi Energy RTU500 series CMU firmware's scored CVEs is 7.4. ## Other products from this vendor - [MicroSCADA X SYS600](https://radicalnotion.ai/vendor/hitachi-energy/microscada-x-sys600) (20 CVEs) - [eSOMS](https://radicalnotion.ai/vendor/hitachi-energy/esoms) (19 CVEs) - [FOXMAN-UN](https://radicalnotion.ai/vendor/hitachi-energy/foxman-un) (15 CVEs) - [UNEM](https://radicalnotion.ai/vendor/hitachi-energy/unem) (15 CVEs) - [RTU500](https://radicalnotion.ai/vendor/hitachi-energy/rtu500) (13 CVEs) - [Asset Suite](https://radicalnotion.ai/vendor/hitachi-energy/asset-suite) (8 CVEs) - [MicroSCADA SYS600](https://radicalnotion.ai/vendor/hitachi-energy/microscada-sys600) (8 CVEs) - [relion 670](https://radicalnotion.ai/vendor/hitachi-energy/relion-670) (8 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/hitachi-energy/rtu500-series-cmu-firmware). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.