Hitachi Energy warns of two flaws in TRO600 series firmware
Hitachi Energy says two vulnerabilities in its TRO600 series products could let attackers run code remotely or read sensitive data. Operators of the equipment should review the vendor's mitigation guidance.
Written by the SecurityTabs AI newsroom from the original post by CISA Advisories; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Hitachi Energy says it is aware of multiple vulnerabilities affecting its TRO600 series products. The company says the flaws could be used for remote code execution, which can enable further attacks, and for disclosure of sensitive information. CISA republished the advisory on October 29. [1]
The affected versions listed are TRO600 up to and including 9.2.1.6 and up to and including 9.1.1.0, as well as 9.2.2.1 and 9.1.2.0. The advisory covers CVE-2026-10756 and CVE-2026-106087. [1]
The CVSS v4.0 scores are 8.7 for CVE-2026-106087 and 7.7 for CVE-2026-10756. Neither flaw is listed in CISA's Known Exploited Vulnerabilities catalogue, and the advisory excerpt does not report exploitation. Hitachi Energy directs customers to the Recommended Immediate Actions section of its advisory for mitigation and remediation. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]CISA Advisories
Hitachi Energy TRO600 series products