Security Advisory

CVE-2026-17539: Hitachi Energy RTU500 DoS (pending)

Last updated:
  • CVE-2026-17539
Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-17539 is a NULL pointer dereference in Hitachi Energy RTU500 series CMU firmware that lets high-load IEC 60870-5-104 traffic, such as frequent general-interrogation requests, crash and restart the communication link, causing a denial of service for the SCADA connection; NVD has not yet completed its own CVSS scoring or CPE analysis, so this page is held as noindex until that analysis is published.

Vulnerability summary

N/A

Not yet scored

0.3%

EPSS score (FIRST)

No

CISA KEV catalog

2026-09-03

Published

Vulnerability ID: CVE-2026-17539 · Source: NVD

Affected components

ComponentCPEVersion range
Hitachi Energy RTU500 series (CMU firmware)—12.7.1 through 12.7.7 (fixed in 12.7.8); 13.5.1 through 13.5.4; 13.6.1 through 13.6.3; 13.7.1 through 13.7.8 (fix planned for 13.7.9); 13.8.1 through 13.8.2 (fix planned for 13.8.3); Hitachi Energy also recommends upgrading to 13.9.1 where available; not yet a published NVD CPE applicability statement

What this means

CVE-2026-17539 (CWE-476, NULL pointer dereference) affects the enhanced message queue of Hitachi Energy's RTU500 series CMU firmware. NVD's description states that "high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue," which "can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication" — IEC 60870-5-104 being a telecontrol protocol widely used between substations and SCADA masters in electric-utility networks (NVD).

NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-21: it records Hitachi Energy's own CNA-submitted CVSS v3.1 score of 5.9 (medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting Hitachi Energy's figure as NVD-confirmed (NVD).

CISA's corresponding ICS advisory, released 2026-10-20, lists the affected firmware ranges above and confirms the fix for the 12.7 branch ships as 12.7.8, while fixes for the 13.7 and 13.8 branches are listed as planned (13.7.9 and 13.8.3); Hitachi Energy also recommends upgrading to 13.9.1 where that is an option. The same advisory bundles eight further CVEs affecting third-party components (OpenSSL, libxml2 and libcurl) used by the RTU500, and recommends isolating control systems behind firewalls, using up-to-date VPNs for remote access, and monitoring for suspicious activity (CISA ICS Advisory ICSA-26-293-05).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-21, and FIRST scores the probability of exploitation at 0.00274 (18.702th percentile) (CISA KEV, FIRST EPSS).

Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, RTU500 operators should apply the available firmware updates and the network-isolation guidance in the CISA advisory.

How to fix this class of issueThis advisory's weakness class is Memory corruption. Our practical guide covers how to detect, fix, verify and disclose it: How to fix memory corruption in embedded firmware.

Evidence

  • High-load IEC 60870-5-104 traffic (e.g. frequent GI requests) can trigger a NULL pointer dereference in the enhanced message queue, causing a fatal write error, connection interruption/restart and denial of service (CWE-476). — NVD
  • NVD status is "Awaiting Analysis" with Hitachi Energy-submitted CVSS v3.1 5.9 (medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, no NVD-published score or CPE configuration as of 2026-10-21. — NVD
  • Affects RTU500 series CMU firmware 12.7.1-12.7.7 (fixed 12.7.8), 13.5.1-13.5.4, 13.6.1-13.6.3, 13.7.1-13.7.8 (fix planned 13.7.9), 13.8.1-13.8.2 (fix planned 13.8.3); recommended mitigations include network isolation and up-to-date VPNs; advisory also bundles 8 third-party-component CVEs. — CISA ICS Advisory ICSA-26-293-05
  • Not present in the CISA KEV catalog as of 2026-10-21. — CISA KEV
  • EPSS score is 0.00274 (18.702th percentile) as of 2026-10-21. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2026-3094: Delta Electronics CNCSoft-G2 Out-of-Bounds Write (pending)CVE-2026-3094: out-of-bounds write in the Delta Electronics CNCSoft-G2 DOPSoft component when parsing DPAX files, local code execution via a malicious project file. Vendor/CISA scoring; NVD has not published a Primary score, so this page is pending.CVE-2026-42026: TOTOLINK X2000R Stack Buffer Overflow (pending)CVE-2026-42026: Cisco Talos found stack-based buffer overflows in TOTOLINK X2000R router firmware enabling code execution; vendor unresponsive since June 2026, NVD status Deferred, page stays noindex.CVE-2026-46300: Linux Kernel skb_try_coalesce() Shared-Fragment FlawCISA KEVCVE-2026-46300: KEV Linux kernel bug where skb_try_coalesce() drops a shared-fragment marker, letting IPsec ESP input corrupt or disclose data in a shared buffer; also patched in Siemens SIMATIC S7-1500 firmware. Sourced to NVD, CISA KEV and kernel.org.

Sources

  1. NVD
  2. CISA ICS Advisory ICSA-26-293-05
  3. CISA KEV
  4. FIRST EPSS