CISA put EOL Hitachi RTU500 on the ICS list. The firmware POST still has no login.

CVE-2026-8065 is unauthenticated firmware upload on CMU 11.x and prior. Supported 12/13 trains are out of this advisory. Not on KEV.

RWP Ventures · 2026-10-07 · event 2026-10-06 · 12 min read · priority 8.7

This is not a KEV row. CISA’s catalog freeze is still 2026.10.04, count 1734, last add CVE-2026-88779, federal due today, 7 October. Hitachi’s SSVC on the RTU500 advisory is E:N (no exploitation evidence as of 28 September). CISA’s ICSA does not claim in-the-wild use. Treat exploitation as UNKNOWN, not as a campaign.

Do not collapse four facts.

1. EOL is the scope. Supported trains are out of this advisory. CISA’s affected line is RTU500 series CMU firmware 11.x and prior (End-of-Life). The CVE record for 8065/8066 is 9.0 before 12.0, default status unaffected. Hitachi: Dragos findings do not affect currently supported CMU firmware; there is a likelihood 11.x and prior are in. The named upgrade is 12.7.8 or 13.9.1 or latest because those are the supported trains, not because 12.0–12.7.7 are in this CVE. CERT-Bund WID-SEC-2026-3658 listed <12.7.8 / <13.9.1 as the product bound. Patch and inventory from the ICSA affected table and the CVE record, not from the German bound as if it were a new vulnerable range.
2. This is firmware write and file write, not a confirmed process event. Successful 8065 is unauthorized firmware on the CMU. Successful CVE-2026-8066 (also 9.1, CWE-23) is unauthenticated path traversal that can write or overwrite files on the device filesystem. Neither advisory describes a loss-of-view or loss-of-control incident. Do not upgrade an energy RTU CVE into a breaker operation.
3. Three of the six IDs are old ICS defects living on leftover firmware. CVE-2010-2965 is Wind River VxWorks WDB on UDP 17185 (CISA 9.8). CVE-2014-9195 is missing authentication on a network service (8.1, AC:H). CVE-2023-46143 is download of code without integrity check (7.5). Their presence on 11.x is the operator fact. The new tickets are 8065, 8066, and authenticated reboot CVE-2026-8067 (6.5).
4. CISA’s 9.8 on the ICSA header is CVE-2010-2965, not 8065. The advisory table scores the equipment CVSS v3 9.8. That is the WDB row. 8065 is 9.1. Do not brief the CISO that “CISA scored the new firmware-upload bug 9.8.”

What happened

Tuesday 6 October, CISA’s ICS index added six advisories. Four are Hitachi Energy republications of 29 September PSIRTs. The RTU500 EOL note is the one that changes an energy operator’s queue.

Hitachi wrote the advisory against Dragos findings on legacy 9.x, then widened the likelihood statement to 11.x and prior because those trains are no longer maintained. Currently supported CMU firmware is stated not affected by these findings. There is no 11.x patch. The close is a supported 12.7 / 13.9 train.

The other three Hitachi republications in the same pack are different products. Do not merge them into one “Hitachi 9.8.”

Also Tuesday: Johnson Controls EasyIO FG ≤2.0b52 (ICSA-26-279-01, hardcoded credentials, not remotely exploitable, product unsold since before 2019, no firmware); Savannah lwIP SMTP 2.2.1 (ICSA-26-279-02, CVE-2026-15340, CISA 9.8, git commit 614420f). Those are the rest of the pack, not this assessment’s lead.

Why it matters

RTU500 is not a building controller and it is not an EAM servlet. It is the field RTU Hitachi Energy sells into energy networks worldwide. A CMU that accepts unauthenticated firmware is a device-integrity problem on the path that already carries telemetry and commands. That is why this outranks yesterday’s Atlassian file read and why it outranks a NetScaler due-date clock.

It still is not a Stage 2 ICS malware report. CISA and Hitachi have not described a victim, a protocol manipulation, or an HMI change. SSVC E:N. The defender action is inventory and isolation of EOL units, then a supported-train migration — not an incident declaration.

This is also not last month’s Hitachi story. [18 September Weekly OT](/posts/2026-09-18-weekly-ot-facts-wartsila-myscada/) was FACTS Control Platform / GWS (ICSA-26-260-03, CVSS 9.9, no versioned fix). Different product, different CVE set, different ticket (8DBD000229).

Who / what is affected

• Energy operators and T&D contractors running RTU500 series CMU firmware 11.x or earlier. Treat 9.x as in. Treat “we bought it in 12” as a version check, not a feeling.
• Engineering access paths that still reach the firmware-update HTTP endpoint, including jump hosts, vendor VPNs, and any RTU management VLAN that is not as air-gapped as the drawing.
• Anyone still exposing UDP 17185 (WDB) on leftover VxWorks images — that row is CVE-2010-2965, not 8065, and it is network-unauthenticated memory access.
• Not in this CVE: currently supported CMU trains, per Hitachi. Not FACTS GWS. Not REB500 libexpat. Not Asset Suite servlets. Those have their own ICSAs in the same day’s index.

Cloud / IT identity stacks are not this advisory. A compromised jump box in front of an EOL RTU is how 8065 becomes reachable. That is an exposure path, not evidence it has been used.

Technical context

CVE-2026-8065 — CWE-306. Firmware update endpoint does not require authentication. Crafted POST, arbitrary firmware, integrity and availability of the CMU. Network, low complexity, no privileges, no user interaction.

CVE-2026-8066 — CWE-23 relative path traversal in file upload. Unauthenticated write/overwrite on the device filesystem. Same 9.1 vector shape as 8065 (C:N/I:H/A:H).

CVE-2026-8067 — CWE-862. Authenticated user can hit a reset endpoint and reboot the RTU. 6.5, PR:L, availability only. Different ticket; do not brief it as unauth.

CVE-2010-2965 — VxWorks WDB target agent. UDP 17185. Read/modify memory, function calls, task management. CISA 9.8. This class is old; on an EOL CMU it is still a listening service.

CVE-2014-9195 — missing authentication on a network service; unauth commands via protocol-compliant traffic. 8.1 with AC:H.

CVE-2023-46143 — CWE-494, download of code without integrity check. Unauth modification of applications on the device. 7.5, integrity only.

ICS ATT&CK mapping of the class, not of observed activity: T0839 Module Firmware (8065), T0859-adjacent file write on the controller filesystem (8066), T0815 Denial of View / availability via reboot (8067). Enterprise T1190 if the update endpoint is reachable from a less-trusted network. None of those IDs are evidence of use.

We are not publishing request paths, POST bodies, or a reproduction. Hitachi left the endpoint unspecified in the public ICSA text beyond “firmware update endpoint” / “crafted POST.” That is sufficient for isolation. It is not a hunting signature.

Threat / exploitation status

Singapore CSA AL-2026-133 (6 October) restates FortiMail CVE-2026-104286 as actively exploited. That is a national-CERT echo of Fortinet FG-IR-26-175 and the 1 October KEV row — not a new FortiMail finding, and not this RTU.

What defenders should do

1. Inventory RTU500 CMU firmware, including spare and retired-but-powered units. Record series, CMU version, management IP, and whether the web/firmware interface is reachable from IT or a vendor path. Anything 11.x or earlier is this advisory. Do not trust a hostname.
2. If it is EOL: isolate first, migrate second. There is no 11.x patch. Pull firmware-update HTTP and unnecessary engineering protocols off every path that is not a dedicated engineering workstation. Internet-facing is the emergency. Dual-homed jump boxes are the common miss. Hitachi’s close is 12.7.8 or 13.9.1 or later supported — plan the outage; do not wait for a hotfix on a train that is out of support.
3. Shut WDB. If UDP 17185 answers on an RTU, that is CVE-2010-2965 regardless of 8065. Block it at the cell firewall. Do not “test” it from the internet.
4. Same day’s other Hitachi tickets, separately. SOI 2.x: install EP2. Asset Suite: disable HTTPPublishAdapterTestServlet and evaluate the four cache/reload servlets; 9.9.1 is still when available. REB500: 8.3.4.0. FACTS GWS from September is still 8DBD000229 / no versioned fix in that ICSA.
5. Do not declare process compromise from the CVE ID. Hunt unexpected CMU reboots, firmware-revision changes, and engineering-session logins. A version string that moved without a change ticket is a lead. It is not proof of 8065.
6. Keep the IT KEV clocks on the board. [NetScaler CVE-2026-88779](/posts/2026-10-05-netscaler-cve-2026-88779-kev/) is due today — SAML overflow, floor 14.1-73.41 / 13.1-64.28, forensic triage Yes. [FortiMail CVE-2026-104286](/posts/2026-10-04-fortimail-cve-2026-104286-due/) was due 4 October; confirm 8.0.2 / 7.6.7 / 7.4.9 as installable ISOs before you retire the IBE workaround. [Atlassian CVE-2026-21589](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/) is yesterday’s self-hosted file read — Crowd floor 7.1.7, Bamboo 10.2.24.

RWP assessment

Score 8.7.

Highest-leverage new development since [yesterday’s Atlassian Daily Top](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/) is CISA putting Dragos’s EOL RTU500 findings on the ICS list: unauthenticated firmware upload on an energy-sector RTU communications module, with a supported-train migration as the only close. Evidence quality is high on the ICSA, the CVE records, and Hitachi’s PSIRT identity. Evidence quality on exploitation is intentionally low.

It outranks a second NetScaler day because CVE-2026-88779 was the 5 October Daily Top; 7 October is the BOD due date, not a new technical finding. It outranks a fourth FortiMail day because Singapore CSA’s 6 October alert restates a KEV row we already assessed 2 October and 4 October. It outranks Hitachi SOI ActiveMQ and Asset Suite servlets because those are real energy-software bugs with (SOI) a patch or (Asset Suite) a disable, and they are not unauthenticated firmware on a field RTU. It outranks lwIP CVE-2026-15340 because the SMTP client is a stack component, not a named T&D RTU family. It outranks EasyIO FG because CISA says not remotely exploitable. It outranks Warlock/SharePoint continuation because that campaign’s documented access is on-prem SharePoint — an IT compromise at a water or telecom firm is not confirmed OT process impact. It outranks a new KEV hunt because there is no new KEV row this freeze.

What we are not saying: that 8065 is confirmed exploited; that 11.x has a patch; that 12.0–12.7.7 are in this CVE; that CISA’s 9.8 header is the new firmware bug; that this is FACTS GWS; that a CMU firmware write has been observed to change protection settings or breaker state; that this CVE is on KEV.

Confidence on the advisory, the EOL scope, the 12.7.8 / 13.9.1 upgrade target, and the KEV freeze: high. Confidence that internet-reachable 11.x units exist: moderate (class of long-lived RTUs; not a census). Confidence of in-the-wild use: low.

What we are watching

• Whether CISA adds CVE-2026-8065 / 8066 to KEV if exploitation against EOL CMUs is confirmed.
• Whether Hitachi or CERT-Bund reconcile the 11.x / before 12.0 affected line with WID-SEC’s <12.7.8 bound.
• Asset Suite 9.9.1 actually shipping.
• NetScaler CVE-2026-88779 due today — [5 October ticket](/posts/2026-10-05-netscaler-cve-2026-88779-kev/).
• FortiMail CVE-2026-104286 ISO confirmation after the 5 October PSIRT solution update.
• Scan telemetry against RTU web interfaces and UDP 17185 (we will not publish a PoC).

Sources

• CISA — ICSA-26-279-06 Hitachi Energy RTU500
• CISA — ICS Advisories
• CISA — ICSA-26-279-03 Asset Suite · ICSA-26-279-04 SOI · ICSA-26-279-05 REB500
• CISA — ICSA-26-279-01 EasyIO FG · ICSA-26-279-02 lwIP SMTP
• Hitachi Energy — 8DBD000251
• Hitachi Energy — PSIRT index
• CVE-2026-8065 · CVE-2026-8066 · CVE-2026-8067
• NVD — CVE-2010-2965
• CISA — KEV JSON catalog 2026.10.04
• CISA — Known Exploited Vulnerabilities Catalog
• CERT-Bund — WID-SEC-2026-3658
• Fortinet FG-IR-26-175
• CSA Singapore — AL-2026-133
• [RWP — Atlassian 21589 Daily Top, 6 October 2026](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/)
• [RWP — NetScaler 88779 KEV Daily Top, 5 October 2026](/posts/2026-10-05-netscaler-cve-2026-88779-kev/)
• [RWP — Weekly OT FACTS, 18 September 2026](/posts/2026-09-18-weekly-ot-facts-wartsila-myscada/)