Hitachi Energy patches seven flaws in RTU500 grid controllers used worldwide
A new advisory from the Swiss vendor lists denial-of-service and authentication-bypass bugs in firmware that runs on remote telemetry units inside electricity networks. Fixes land in CMU Firmware 13.9.1.
Key points
- Hitachi Energy has disclosed seven vulnerabilities in the RTU500 series CMU Firmware, the software running on remote telemetry units that sit inside electricity substations worldwide, with fixes consolidated in version 13.9.1.
- The highest-rated flaw, CVE-2026-28388, carries a CVSS score of 7.5 and sits in the OpenSSL component used for HTTPS access on the device.
- CISA republished the advisory on 3 September 2026, flagging the Energy sector as the deployment context.
- Five firmware branches are affected, from 12.7.1 through 13.8.2, and operators on the 13.7 and 13.8 lines face a staggered patch schedule.
- All seven bugs lead to denial of service or credential exposure; none are described by the vendor as enabling remote code execution.
Hitachi Energy has published a security advisory for its RTU500 series, the remote telemetry units that utilities use to monitor and control equipment inside electricity substations. The advisory lists seven distinct vulnerabilities across five firmware branches. CISA mirrored the notice on 3 September 2026. We covered a related Hitachi Energy disclosure on 6 October 2026, when a pair of XML parser flaws threatened the company's REB500 protection relay; that pattern, inherited library bugs showing up in grid hardware, runs through this advisory too.
The RTU500 is not a consumer product. It sits in a locked cabinet at a substation, reading sensor data and passing switching commands back to a control room. The device runs what Hitachi calls CMU Firmware, and that firmware is what the advisory addresses.
What are the actual flaws?
Three of the seven have detailed public records so far. The most serious, CVE-2026-28388, is a NULL pointer dereference in OpenSSL's handling of delta certificate revocation lists. A malformed file sent during the HTTPS handshake can crash the certificate-checking process. OpenSSL rated the underlying issue Low in its own policy, but inside the RTU500 context it scores 7.5.
CVE-2026-17539, scored 5.9, is more specific to the device's job. Sending General Interrogation requests at short intervals over IEC 60870-5-104, the protocol substations use to exchange telemetry, can trigger a fatal write error and knock out two-way communication until the unit restarts. For an operator watching a control-room screen, that reads as a substation going dark.
The third disclosed bug, CVE-2026-6732, is a type confusion in the libxml2 library when it validates XML against a schema. A crafted document crashes the service. CVSS 6.5.
The remaining four CVEs cover use-after-free, cleartext transmission of credentials, insufficiently protected credentials, and authentication bypass by capture-replay. They're referenced in the advisory but not yet detailed in public NVD records.
Which versions need patching?
| Firmware branch | Affected range | Fixed version |
|---|---|---|
| 12.7 | 12.7.1 to 12.7.7 | 12.7.8 or 13.9.1 |
| 13.5 | 13.5.1 to 13.5.4 | 13.9.1 |
| 13.6 | 13.6.1 to 13.6.3 | 13.9.1 |
| 13.7 | 13.7.1 to 13.7.8 | 13.9.1, or 13.7.9 when available |
| 13.8 | 13.8.1 to 13.8.2 | 13.9.1, or 13.8.3 when available |
Operators on the 13.7 and 13.8 branches should read the wording carefully. Point-release fixes on those branches are marked as pending, so the immediate route to a patched state is the jump to 13.9.1.
Should grid operators be worried?
Availability is the realistic risk here, not takeover. Every flaw with a published description leads to a crash, a restart, or credential exposure. None of the three detailed CVEs can be escalated to code execution, according to the upstream project notes.
Availability is also the whole point of a substation controller. A denial-of-service bug on IEC 60870-5-104 isn't a theoretical nuisance; it's the loss of the channel a control room uses to see what a breaker is doing. Hitachi's standing guidance, that RTU500 devices should sit on isolated process networks unreachable from corporate IT, matters more than usual while the 13.7 and 13.8 point-releases are still pending.
My read: most of these CVEs are inherited from OpenSSL and libxml2, and the IEC 104 bug is the only one native to Hitachi's own code. The awkward edge is the staggered fix schedule. Utilities that validated 13.8 in the lab now have to either accept an unpatched window or qualify a 13.9 jump they weren't planning for this cycle.
