Hitachi Energy TRO600: Arbitrary file read without authentication
Summary
The Hitachi Energy TRO600 industrial wireless router series contains an arbitrary file read vulnerability. An unauthenticated attacker with network access can read or download arbitrary files on the device, including configuration files and password data. No exploitation in the wild and no public proof of concept are known, but the exposure of the device determines the risk.
Affected
- TRO600 Series firmware 9.0.0.0 to 9.1.1.0 according to the CVE record of the CNA (Hitachi Energy)
- CISA ICSA-26-302-02 lists TRO600 versions 9.1.1.0 and prior as affected
- The lower bound of the range is not confirmed by Hitachi or CISA in the sources reviewed
Fixed in
- Firmware 9.1.2.0 for the 9.1.x branch (according to secondary reporting and the CISA advisory; please confirm in the Hitachi advisory)
- Firmware 9.2.2.1 is the fix for the companion CVE-2026-10756 and is recommended as the latest release
Workaround
Unknown. The sources reviewed do not describe interim mitigations. Check the 'Recommended Immediate Actions' section of the CISA advisory and the Hitachi advisory.
Exploitation
- Not known to be exploited (OffSeq); not listed in KEV according to Strix
- No public proof of concept found; VulDB states that no exploit is available
Our recommendation
- Inventory all TRO600 devices and record their firmware versions
- Check whether any management interface or web service is reachable from the internet or via a public cellular APN, and close such exposure
- Plan the upgrade to the fixed firmware and rotate device and network credentials after patching if the device was exposed
- Restrict management access to a segregated network and monitor access to the device
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Hitachi Energy PSIRT advisory 8DBD000224 publisher.hitachienergy.com
- CISA ICS advisory ICSA-26-302-02 www.cisa.gov
- OffSeq Radar: CVE-2026-106087 radar.offseq.com
- VulDB entry 427178 vuldb.com
- Strix CVE details: CVE-2026-106087 www.strix.ai
- Security Boulevard: Daily OT Security News, October 30, 2026 securityboulevard.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:57.
Original description (NVD)
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.