CISA warns of vulnerabilities in Hitachi Energy TRO600 routers

CISA published an advisory on Oct. 29, 2026 warning of vulnerabilities in Hitachi Energy TRO600 series wireless routers. The flaws can enable remote code execution, letting an attacker run commands on a device, and expose sensitive data for follow-on attacks. The routers operate worldwide across the Energy critical infrastructure sector.

CISA first issued the advisory on Oct. 27, 2026. It republished the advisory on Oct. 29 as a verbatim conversion of Hitachi Energy PSIRT 8DBD000224 under the Common Security Advisory Framework. The agency provides the republished advisory as-is for informational purposes, offers no warranties, and disclaims responsibility for its editorial or technical accuracy. The agency rejects commercial endorsements and sends questions to Hitachi Energy PSIRT.

Affected versions include TRO600 vers:TRO600/<=9.2.1.6, vers:TRO600/<=9.1.1.0, 9.2.2.1, and 9.1.2.0. The advisory associates these versions with CVE-2026-10756 and CVE-2026-106087. These version strings appear in the advisory’s affected products list. CISA links CVEs with affected versions.

It also includes an SSVC field, a vulnerability prioritization notation, dated Oct. 26, 2026.

On Feb. 16, 2022, Hitachi Energy brought out TRO600 wireless routers equipped with 5G. Hitachi Energy built the routers with industrial and utility customers in mind, targeting high reliability and resiliency for mission-critical operations. The series runs a hybrid wireless architecture mixing public and private cellular with broadband mesh, all managed through one network system.

Massimo Danieli said, “At Hitachi Energy, we are proud to pioneer 5G-enabled communication devices for industrial and utility customers, ensuring connectivity where and when it matters most.” Launch materials describe the routers as purpose-built for customers in industrial and utility settings.

Chantal Polsonetti said, “5G delivers significant connectivity performance improvements.” Her comment appeared in coverage of Hitachi Energy’s February 2022 push to bring 5G connectivity to mission-critical industrial and utility operations. The reporting framed 5G as a step toward major performance gains for those networks.

The TRO670 hybrid wireless router joined the TRO600 series on Feb. 28, 2024, as its newest member. Hitachi Energy made the TRO670 a ruggedized router carrying wireless technologies and fiber links for use in remote and harsh settings. The router works with earlier products across Hitachi Energy’s wireless lineup and features a multi-layer security architecture.

ARC Advisory Group describes the TRO670’s certificate-based Industrial Internet of Things security as using public key infrastructure, a system that verifies identities and encrypts communications through digital certificates. It handles public and private 4G cellular service, broadband mesh on the 2.4GHz and 5GHz bands, and Wi-Fi access points. The router is IP67 certified, a rating for protection against dust and water, and is edge-compute ready. An optional internal backup battery keeps the router running without outside power for hours.

Hitachi Energy has its headquarters in Switzerland. Hitachi Energy’s installed base reaches more than 140 countries. It has around 38,000 employees in 90 countries and brings in about $10 billion USD in business volume. The firm also serves industrial and utility customers around the world.

The agency urges operators to limit network exposure for every control system device and keep those devices off the internet. CISA says networks running control systems and their remote devices should sit behind firewalls, kept apart from business networks. Reduced network exposure appears in the advisory’s Recommended Practices as a defensive measure.

If remote access is necessary, CISA points to more secure choices, such as Virtual Private Networks. The agency warns that VPNs can contain flaws, need updates to the latest version, and provide security only equal to the devices attached to them. The advisory’s Recommended Practices section covers remote access and VPN use.

The agency tells organizations to finish impact analysis and risk assessment before deploying defensive measures. Groups that spot suspected malicious activity should follow internal steps and send findings to CISA for tracking and correlation. CISA uses those reports for tracking and correlation.

Basic security practices call for physically guarding process control systems against unauthorized personnel and blocking direct internet connections. CISA prohibits using industrial control systems for web browsing, instant messaging, or receiving e-mails. Before connecting portable computers or removable storage media to a control system, CISA advises scanning them for viruses. The advisory’s General Mitigation Factors section covers these practices.