7.7
HighCVSS 4.0 · from Hitachi Energy
CVE-2026-10756
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost.
TRO600 Series Firmware · CWE-923 · CWE-923AffectedTRO600 Series Firmware
FixNo fix listed yet.
PublishedOct 27, 11:56 · Hitachi Energy
ScoredOct 27 · 7.7 · Hitachi Energy
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.
From Hitachi Energy
Affected and fixed versions
ProductAffectedFixed inTRO600 Series Firmware9.0.0.0 – 9.2.1.6–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known