Hitachi Energy says it is aware of multiple vulnerabilities affecting its TRO600 series products. The company says the flaws can be exploited for remote code execution and disclosure of sensitive information. The advisory was republished by CISA on 2026-10-29 from Hitachi Energy PSIRT 8DBD000224.
The advisory lists two vulnerabilities. The first is CVE-2026-10756, which Hitachi Energy describes as a flaw that lets an authenticated attacker bypass network access restrictions. According to the advisory, an attacker can use port forwarding to reach locally bound ports and services. The advisory says this can lead to unauthorized access to sensitive functionality and confidential information, and can affect availability. It affects TRO600 version 9.2.1.6 and prior. The vendor fix is to update to version 9.2.2.1. The CVSS v3.1 base score is 7.5 (High), and the relevant CWE is CWE-923.
The second is CVE-2026-106087, which the advisory describes as an arbitrary file read vulnerability. The advisory says an unauthenticated attacker can read or download arbitrary files on the affected device, including sensitive configuration files and password data. It