CVE-2026-17539
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.
| CWE | CWE-476 |
| Vendor | hitachi energy |
| Product | rtu500 series cmu firmware |
| Published | Sep 3, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for hitachi energy rtu500 series cmu firmware
Be the first to know when new medium vulnerabilities affecting hitachi energy rtu500 series cmu firmware are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Hitachi Energy / RTU500 series CMU firmware
12.7.1 ≤ 12.7.7 13.5.1 ≤ 13.5.4 13.6.1 ≤ 13.6.3 13.7.1 ≤ 13.7.8 13.8.1 ≤ 13.8.2