{"id":"CVE-2026-106087","kind":"vulnerability","aliases":["CVE-2026-106087"],"related":[],"title":"TRO600 router: unauthenticated arbitrary file read exposes configs and passwords","description":"TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.","summary":"Hitachi Energy TRO600 series radios/routers: an unauthenticated network attacker can read or download arbitrary files, including configuration and password data (missing authentication, CWE-306). Affected firmware per the CNA record: 9.0.0.0 through 9.1.1.0. No exploitation or public PoC found.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TRO600","fixed":[],"affected":">= 9.0.0.0, <= 9.1.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded-device","hitachi-energy","infrastructure","network-appliance","tro600","tropos"],"not_affected_if":[],"how_to_check":"Check TRO600 firmware version in the device web UI or via SuprOS; versions 9.0.0.0 through 9.1.1.0 are affected. Fixed version: see Hitachi Energy advisory 8DBD000224 (not readable by us).","fix":"unknown: see Hitachi Energy advisory 8DBD000224; until then restrict management access to the device (no internet exposure, firewall/segment it) and rotate credentials stored on it if exposed.","status":"open","published_at":"2026-10-27T12:17:04+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","triaged_at":"2026-10-27T12:31:56+00:00","updated_at":"2026-10-27T12:33:33+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T12:31:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"TRO600 router: unauthenticated arbitrary file read exposes configs and passwords","impact":"high","summary":"The TRO600 device has an arbitrary file read flaw that an unauthenticated remote attacker can trigger to download any file on the device. Sensitive configuration files and stored password data can be disclosed.","category":"infrastructure","nicknames":[],"who_cares":["tro600","embedded-device","network-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker downloads device config files and stored passwords without logging in","analyst_note":"Find the vendor advisory and affected firmware versions for TRO600; the NVD entry gives no product version, patch, or check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000499,"input_tokens":3285,"output_tokens":341,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected firmware versions for TRO600; the NVD entry gives no product version, patch, or check.","search":"'-106087':13A,16A '-2026':12A,15A '-306':53B '9.0.0.0':60B '9.1.1.0':62B 'affect':54B,91C 'applianc':27B 'arbitrari':4A,43B,72C,87C 'attack':38B,78C 'authent':51B 'cna':58B 'config':8A 'configur':46B,95C 'contain':70C 'cve':11A,14A 'cwe':52B 'data':49B,99C 'devic':20B,92C 'disclosur':103C 'download':42B,86C 'embed':19B 'embedded-devic':18B 'energi':23B,31B 'exploit':64B,80C 'expos':7A 'file':5A,44B,73C,88C,96C 'firmwar':55B 'found':68B 'hitachi':22B,30B 'hitachi-energi':21B 'includ':45B,93C 'inform':106C 'infrastructur':24B 'miss':50B 'network':26B,37B 'network-appli':25B 'password':10A,48B,98C 'per':56B 'poc':67B 'public':66B 'radios/routers':34B 'read':6A,40B,74C,84C 'record':59B 'result':100C 'router':2A 'sensit':94C,105C 'seri':33B 'tro600':1A,17A,28B,32B,69C 'tropo':29B 'unauthent':3A,36B,77C 'vulner':75C,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cybersecurity@hitachienergy.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106087","severity":null,"published_at":"2026-10-27T12:17:04+00:00","modified_at":"2026-10-27T12:17:04+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","fetched_at":"2026-10-27T12:31:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106087:874","url":null,"severity":null,"published_at":"2026-10-27T12:33:33+00:00","modified_at":"2026-10-27T12:33:33+00:00","first_seen_at":"2026-10-27T12:33:33+00:00","fetched_at":"2026-10-27T12:33:33+00:00","note":"Hitachi Energy CNA record (cve.org): TRO600 firmware 9.0.0.0-9.1.1.0 affected, CWE-306, CVSS4 8.7; vendor advisory 8DBD000224 is behind a JS/cookie wall so fixed version and mitigations are unread, nothing marked verified. No exploitation or PoC found."}],"documents":[{"id":6304,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106087","title":"CVE Record CVE-2026-106087 (Hitachi Energy CNA)","kind":"advisory","source":"analyst","text":"TRO600 arbitrary file read, unauthenticated, CWE-306, CVSS 4.0 8.7. Affected from 9.0.0.0 through 9.1.1.0. Reference: Hitachi Energy advisory 8DBD000224.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":6305,"url":"https://publisher.hitachienergy.com/preview?DocumentID=8DBD000224&LanguageCode=en&DocumentPartId=&Action=Launch","title":"Hitachi Energy Cybersecurity Advisory 8DBD000224 - Multiple vulnerabilities (TRO600)","kind":"vendor","source":"analyst","text":"Vendor advisory referenced by the CVE record; page title says Multiple vulnerabilities. Body could not be retrieved.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}