CVE-2026-8066
- State
- Published
- Severity
- 9.1 Critical
- Published
- Sep 29, 2026
- Updated
- Sep 29, 2026
- Reserved
- May 7, 2026
Description
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | Hitachi Energy |
Weaknesses
- CWE-23 Relative path traversal
Affected Products
| Product | Versions |
|---|---|
RTU500 series CMU firmwareHitachi Energy |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.