CVE-2026-8479 Null dereference in RTU500 series CMU firmware
A specially crafted message sequence causes a null pointer dereference in RTU500 firmware, leading to denial of service when bidirectional IEC 60870-5-104 is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8479?
CVE-2026-8479 is a medium-severity vulnerability in Hitachi Energy RTU500 series CMU firmware, published on 26 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a certain time, causing Denial of Service impact. Product is only affected if IEC 60870-5-104 functionality in bidirectional mode (BCI) is configured.
Weakness: CWE-476
Which versions are affected by CVE-2026-8479?
How do I fix CVE-2026-8479?
No fix has been published for CVE-2026-8479 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-8479 being exploited?
There is no known exploitation of CVE-2026-8479 in the wild and no public exploit code.
Sources
Also known as GHSA-m2rr-g8pf-8wrj.