Severity: CriticalAction: Mitigate
Hitachi Energy RTU500 Product
Mitigate
No complete fix is indicated yet.
Vulnerability record
CVE-2026-17539
Severity: ElevatedExploitation: No known exploitation
Patch status
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.
Description
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Intelligence timeline
Developments from the last 30 days, newest first.
- CVSS scoredUpdate
CVE-2026-17539 scored CVSS 5.9
Basis: NIST National Vulnerability Database