Hitachi Energy TRO600 Series Vulnerabilities (CVE-2026-10756, CVE-2026-106087)

Hitachi Energy TRO600 series products contain two high-severity vulnerabilities. CVE-2026-10756 allows an authenticated attacker to bypass network restrictions and access services intended to be reachable only from localhost via port forwarding. CVE-2026-106087 allows an unauthenticated attacker to perform arbitrary file reads, potentially exposing sensitive configuration files and credentials. No evidence of in-the-wild exploitation was provided in the advisory.

Impact

Successful exploitation may result in unauthorized access to sensitive functionality, disclosure of confidential information including password data, and availability impact on Industrial Control System (ICS) environments.

Recommendation

• Update TRO600 series devices to version 9.2.2.1 or 9.1.2.0 as applicable to remediate identified vulnerabilities.
• Minimize network exposure for all control system devices by ensuring they are not directly accessible from the internet.
• Isolate control system networks behind firewalls and utilize VPNs for remote access, ensuring VPN infrastructure is kept current.
• Implement defense-in-depth strategies as outlined in CISA's ICS cybersecurity best practices.