Hitachi Energy TRO600: two high-severity vulnerabilities in the routers, fixed in version 9.2.2.1

Hitachi Energy disclosed two high-severity vulnerabilities in its TRO600 series, routers for the wireless communications networks of electricity grids and industrial plants. The fix is the same for both: update the software to version 9.2.2.1. The company’s advisory (PSIRT 8DBD000224) was released on Tuesday, October 27, 2026, and the US Cybersecurity and Infrastructure Security Agency (CISA) republished it on Thursday, October 29 as ICSA-26-302-02.

CISA did no analysis of its own: as it states, the text is a verbatim republication of Hitachi Energy’s advisory, converted from the CSAF format (Common Security Advisory Framework, a standard for machine-readable security advisories). It takes no responsibility for its accuracy and refers readers to the PSIRT, the company’s product security incident response team.

CVE-2026-106087: arbitrary file read

The more serious of the two, on the CVSS 4.0 score, is CVE-2026-106087, an arbitrary file read flaw (CWE-306, missing authentication for a critical function). An unauthenticated attacker can read or download files from the device, including sensitive configuration files and password data, disclosing confidential information. The CVSS (Common Vulnerability Scoring System, a severity scale from 0 to 10) score is 7.5 on version 3.1 and 8.7 on 4.0, “high” in both. The attack is carried out over the network, with low complexity and without privileges or user action. Versions 9.1.1.0 and earlier, as well as 9.2.1.6 and earlier, are affected. For the 9.1 series the fix came with 9.1.2.0, while Hitachi Energy recommends updating to the latest, 9.2.2.1.

CVE-2026-10756: bypassing restrictions

The second, CVE-2026-10756 (CWE-923, improper restriction of communication channels to intended endpoints), requires an attacker who is already authenticated on the device. They can bypass the network’s access restrictions and, through port forwarding, reach services intended for use only by the device itself (localhost). They thus gain access to sensitive functions and confidential information, and availability is affected too. It scores 7.5 on CVSS 3.1 and 7.7 on CVSS 4.0, with high attack complexity and low privileges. It concerns versions up to and including 9.2.1.6 and is fixed in 9.2.2.1.

In the advisory’s summary Hitachi Energy notes that the vulnerabilities could be exploited for remote code execution (RCE) to mount further attacks, as well as to disclose sensitive information. They were reported to CISA by the company’s internal team. Energy is listed as the critical infrastructure sector, and the products are used worldwide.

What the TRO600 does

The TRO600 series combines cellular connectivity (with 5G since 2022) and an 802.11 broadband mesh network, as the company describes it. The TRO620 model, for example, is DIN-rail mounted and was designed for field networks and electricity distribution automation. It connects smart electrical devices, industrial process controllers and SCADA devices, that is, supervisory control and data acquisition systems.

Beyond the update, the advisory repeats the general practices for industrial control systems: physical protection from unauthorised personnel, no direct connection to the internet, and separation from other networks by a firewall that leaves as few ports open as possible. Control systems should not be used for browsing, messaging or e-mail, and laptops and storage media should be scanned for viruses before connecting.

CISA adds its own recommendations: minimise network exposure of devices, place them behind firewalls and, where remote access is needed, use more secure methods such as virtual private networks (VPNs), which must themselves be kept up to date. Organisations report suspicious activity to the agency. For vulnerabilities that attackers are already exploiting, CISA maintains a separate catalog: on October 29 it added two such flaws in GitLab and Cisco products to its KEV catalog.