CVE-2026-106087 PUBLISHED

Assigner: Hitachi Energy
Reserved: 06.10.2026 Published: 27.10.2026 Updated: 27.10.2026

TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor Hitachi Energy
Product TRO600 Series Firmware
Versions Default: unaffected
  • affected from 9.0.0.0 to 9.1.1.0 (incl.)

References

Problem Types

  • CWE-306 Missing authentication for critical function CWE

Impacts

  • CAPEC-150 Collect Data from Common Resource Locations