Zero Radar
← feed
HighVulnerabilityCVE-2026-10756updated 29 Oct 2026, 14:59 UTC

Hitachi Energy TRO600 lets logged-in users reach internal-only services

A logged-in user of the TRO600 device can get around network rules and reach services that should only be used from inside the device itself. This can expose private settings and data, or disrupt the device.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesUpdate to version 9.2.2.1 · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Authenticated userAttacker already has a login
  2. 2Port forwardingTraffic routed through the device
  3. 3Localhost-only servicesInternal ports reached directly
  4. 4Sensitive accessConfidential information exposed
  5. ResultRestricted services exposed to attacker

What happened

CVE-2026-10756 is a restricted-communication flaw (CWE-923) in Hitachi Energy TRO600. An authenticated attacker can abuse port forwarding to interact with locally bound ports and services that should only be reachable from localhost.

Why it is dangerous: Attackers could read confidential information, reach sensitive functions, and affect availability of the device, which is used in the energy sector.

Are you affected?

You are affected if you run TRO600 version 9.2.1.6 or earlier.

TRO600 version 9.2.1.6 and prior

What to do

  1. Update TRO600 to version 9.2.2.1 or later
  2. Limit who has login accounts on TRO600 devices until the update is applied
  3. Review Hitachi Energy's advisory for any additional recommended actions

Timeline

  1. 27 Oct 2026, 12:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 12:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 12:18 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 14:59 UTC
    CISA reported on it · CISA

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-10756
CVSS
7.7 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 12:17 UTC
On Zero Radar
27 Oct 2026, 12:18 UTC (1 min after disclosure)
Last change
29 Oct 2026, 14:59 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Hitachi Energy TRO600 lets logged-in users reach internal-only services · Zero Radar