CVE-2026-1773 Denial of service in RTU500 series CMU firmware
Attackers can cause denial of service in Hitachi RTU500 devices by sending invalid IEC 60870-5-104 frames when bi-directional functionality is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-1773?
CVE-2026-1773 is a high-severity denial of service vulnerability in Hitachi Energy RTU500 series CMU firmware, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality is configured. Enabling secure communication following IEC 62351-3 does not remediate the vulnerability but mitigates the risk of exploitation.
Weakness: CWE-184
Which versions are affected by CVE-2026-1773?
It affects 4 products.
Products include Hitachienergy Rtu520 Firmware, Hitachienergy Rtu530 Firmware, Hitachienergy Rtu540 Firmware, Hitachienergy Rtu560 Firmware.
How do I fix CVE-2026-1773?
No fix has been published for CVE-2026-1773 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-1773 being exploited?
There is no known exploitation of CVE-2026-1773 in the wild and no public exploit code.
Other vulnerabilities in Hitachi Energy RTU500 series CMU firmware
Sources
Also known as GHSA-q2vg-xgjr-32v3.