A Sixteen-Year-Old Debug Port in RTU Firmware Still in Service

CISA republished a Hitachi Energy advisory on 6 October as ICSA-26-279-06, covering six vulnerabilities in RTU500 series CMU firmware version 11.x and earlier. That firmware line is already designated end-of-life.

Two of the findings are new and both score 9.1. CVE-2026-8065 is an authentication bypass in the firmware update endpoint: in CISA's words, it allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. CVE-2026-8066 is a relative path traversal in the file upload function that allows writing or overwriting arbitrary files on the device file system. CVE-2026-8067, at 6.5, lets an authenticated user reboot the unit through the reset endpoint.

The other three are inherited. CVE-2023-46143, at 7.5, is a download of code without an integrity check. CVE-2014-9195, at 8.1, is unauthenticated remote command execution using protocol-compliant traffic. And CVE-2010-2965, at 9.8, is the Wind River VxWorks WDB target agent debug service reachable on UDP port 17185 — a flaw that has been publicly documented since 2010 and is still present in firmware running in substations in 2026.

Hitachi Energy strongly recommends upgrading to RTU500 CMU firmware 12.7.8, 13.9.1 or later. CISA's generic advice applies: minimise network exposure, isolate behind firewalls. Dragos reported the new findings.

Two things stand out beyond the scores. RTU500 units carry SCADA telemetry and control commands for substation bays, so unauthenticated firmware upload is the shortest available path from network access to persistent control of primary plant. And the presence of a sixteen-year-old debug port is a measurement rather than an anecdote: it says how long end-of-life OT equipment stays in service, which is longer than any patch policy assumes.

That Dragos found these rather than a laboratory is the detail worth keeping. The firmware was not an archived sample; it was running somewhere.