CVE-2026-106087: Hitachi Energy TRO600 Grid Router Unauthenticated Arbitrary File Read (pending)

CVE-2026-106087 is a missing-authentication flaw (CWE-306) in Hitachi Energy's TRO600 series mission-critical wireless grid routers that lets an unauthenticated network attacker read or download arbitrary files, including configuration files and password data; NVD has not published its own CVSS score for this vendor-reported vulnerability.

CVE-2026-106087 affects the Hitachi Energy TRO600 series, a line of ruggedized, factory-integrated hybrid wireless routers (branded Tropos) combining 2G/3G/4G LTE and 5G cellular with self-healing broadband mesh networking; Hitachi Energy markets the TRO600 family for smart-grid and industrial-IoT communications, including streamlined distribution links to outage management systems and dispatch, asset performance management and grid-modernization links across utility, oil-and-gas and mining sites (Hitachi Energy news).

NVD's description states: "TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information" — CWE-306 (Missing Authentication for a Critical Function), CNA-assigned by Hitachi Energy's own PSIRT (NVD).

CVE-2026-106087's NVD status is "Deferred" as of 2026-10-31, meaning NVD's own analysis is pending and NVD has published no Primary score. The only figure on record is Hitachi Energy's own CNA submission: CVSS v4.0 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N), stored as Secondary, not NVD-confirmed. Hitachi Energy's published CSAF advisory additionally scores it CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) — both reflect a network-reachable, no-authentication, no-user-interaction flaw limited to confidentiality impact (NVD).

CISA's advisory bundles this with a second TRO600 flaw, CVE-2026-10756 (CWE-923, improper restriction of communication channel): an authenticated attacker can bypass network access restrictions and reach services intended to stay bound to localhost by leveraging port forwarding, with availability impact on top of the confidentiality/integrity exposure (CVSS v3.1 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's summary for the pair states the vulnerabilities "can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information." Both vulnerabilities were found by Hitachi Energy's own internal team rather than an external researcher (CISA ICS Advisory ICSA-26-302-02).

CVE-2026-106087 is fixed in TRO600 firmware 9.1.2.0 and later (affecting builds 9.1.1.0 and earlier); the companion CVE-2026-10756 is fixed in 9.2.2.1 (affecting builds 9.2.1.6 and earlier). Hitachi Energy's advisory directs all TRO600 operators to update to the latest available version, 9.2.2.1, which carries fixes for both flaws, and — per CISA's standard ICS guidance reproduced in the advisory — to minimize network exposure of control-system devices, place them behind firewalls isolated from business networks, and use VPNs rather than direct exposure when remote access is required (CISA ICS Advisory ICSA-26-302-02).

As of 2026-10-30, CVE-2026-106087 is not listed in the CISA Known Exploited Vulnerabilities catalog, and FIRST scores the probability of exploitation at 0.00247 (16.1th percentile) as of 2026-10-31 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. TRO600 operators should update to firmware 9.2.2.1 and restrict management-plane access to trusted networks in the meantime.

• TRO600 contains an unauthenticated arbitrary file read vulnerability (CWE-306) letting an attacker download sensitive files including configuration data and passwords. — NVD
• No NVD Primary score; Hitachi Energy's own CNA submission is CVSS v4.0 8.7 (Secondary), with the published CSAF advisory additionally scoring it CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). — NVD
• Bundled with companion CVE-2026-10756 (authenticated localhost-service bypass via port forwarding, CVSS v3.1 7.5); CISA's summary states the pair can be exploited for remote code execution and sensitive-information disclosure; found by Hitachi Energy's internal team. — CISA ICS Advisory ICSA-26-302-02
• TRO600 is a ruggedized hybrid-wireless (cellular + mesh) router branded Tropos, marketed for smart-grid and industrial-IoT communications including outage-management/dispatch distribution links, asset performance management and grid modernization. — Hitachi Energy news
• Fixed in TRO600 firmware 9.1.2.0 (this CVE) and 9.2.2.1 (companion CVE); Hitachi Energy directs all operators to update to the latest 9.2.2.1 build. Not present in the CISA KEV catalog as of 2026-10-30; EPSS score is 0.00247 (16.1th percentile) as of 2026-10-31. — FIRST EPSS