CISA published an ICS advisory covering multiple vulnerabilities in Hitachi Energy’s TRO600 series edge computing/wireless products, deployed worldwide in the energy sector. The flaws include missing authentication for a critical function and improper restriction of communication channels, and can be chained to achieve remote code execution and disclosure of sensitive information.
One flaw (CVE-2026-10756) lets an authenticated attacker bypass network access restrictions and reach services intended only for localhost by abusing port forwarding, effectively interacting with locally bound services that should be unreachable. The missing-authentication issue is particularly concerning from an access-control standpoint, as it weakens the trust boundary around critical device functions.
What to take away: In OT/ICS environments, weak authentication and access-restriction bypasses on networked devices can give attackers a foothold for lateral movement and privilege escalation. Operators should apply Hitachi Energy’s recommended mitigations, restrict network exposure, and treat these devices as high-value identity boundaries.