Zero Radar
← feed
HighVulnerabilityCVE-2026-106087updated 29 Oct 2026, 14:59 UTC

Hitachi Energy TRO600 devices can leak sensitive files to attackers

Someone on the network without logging in could download files from the device, including configuration files and stored passwords. Those passwords could then be used to take control of the device.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesUpdate to version 9.2.2.1 (latest). Version 9.1.2.0 fixes the 9.1.x line. · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerReaches device over the network
  2. 2Requests file pathNo login or credentials needed
  3. 3Device returns fileArbitrary file read on TRO600
  4. 4Passwords exposedConfig and password data disclosed
  5. ResultAttacker gains sensitive data and credentials

What happened

Hitachi Energy TRO600 contains an unauthenticated arbitrary file read flaw (CVE-2026-106087, CWE-306 missing authentication for a critical function), which CISA reports is part of a group of vulnerabilities that can also enable remote code execution and information disclosure.

Why it is dangerous: Attackers can read configuration and password data without credentials, enabling further attacks on energy-sector equipment deployed worldwide.

Are you affected?

You are affected if you run Hitachi Energy TRO600 devices at version 9.2.1.6 or earlier, or version 9.1.1.0 or earlier.

TRO600 version 9.2.1.6 and prior; TRO600 version 9.1.1.0 and prior

What to do

  1. Update TRO600 to version 9.2.2.1 or the latest available release
  2. If patching is not possible right away, restrict network access to the device to trusted management hosts only
  3. Review device configuration files and change any passwords that may have been exposed

Timeline

  1. 27 Oct 2026, 12:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 12:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 12:18 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 14:59 UTC
    CISA reported on it · CISA

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-106087
CVSS
8.7 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 12:17 UTC
On Zero Radar
27 Oct 2026, 12:18 UTC (1 min after disclosure)
Last change
29 Oct 2026, 14:59 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Hitachi Energy TRO600 devices can leak sensitive files to attackers · Zero Radar