Hitachi Energy TRO600 series products

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-302-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information. Please refer to the Recommended Immediate Actions section for information about the mitigation/remediation.</strong></p> <p>The following versions of Hitachi Energy TRO600 series products are affected:</p> <ul> <li>TRO600 vers:TRO600/&lt;=9.2.1.6, vers:TRO600/&lt;=9.1.1.0, 9.2.2.1, 9.1.2.0 (CVE-2026-10756, CVE-2026-106087)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role="columnheader" data-tablesaw-priority="persist">CVSS</th> <th role="columnheader">Vendor</th> <th role="columnheader">Equipment</th> </tr> </thead> <tbody> <tr> <td>v3 7.5</td> <td>Hitachi Energy</td> <td>TRO600</td> </tr> </tbody> </table> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role="columnheader" data-tablesaw-priority="persist">2 Vulnerabilities</th> </tr> </thead> <tbody> <tr> <td>Improper Restriction of Communication Channel to Intended Endpoints, Missing Authentication for Critical Function</td> </tr> </tbody> </table> </div> <h3>Background</h3> <ul> <li><strong>Critical Infrastructure Sectors: </strong>Energy</li> <li><strong>Countries/Areas Deployed: </strong>Worldwide</li> <li><strong>Company Headquarters Location: </strong>Switzerland</li> </ul> <hr> <h2>Vulnerabilities</h2> <div class="icsa-etb-toggle-wrapper"><a class="icsa-etb-toggle-all" href="#">Expand All +</a></div> <div class="c-expandable-textbox icsa-etb"> <div class="c-expandable-textbox__title">CVE-2026-10756</div> <div class="c-expandable-tex