---
id: "CVE-2026-106087"
kind: "vulnerability"
aliases: ["CVE-2026-106087"]
title: "TRO600 router: unauthenticated arbitrary file read exposes configs and passwords"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TRO600", "fixed": [], "affected": ">= 9.0.0.0, <= 9.1.1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded-device", "hitachi-energy", "infrastructure", "network-appliance", "tro600", "tropos"]
not_affected_if: []
published_at: "2026-10-27T12:17:04+00:00"
first_seen_at: "2026-10-27T12:31:37+00:00"
updated_at: "2026-10-27T12:33:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106087", "first_seen_at": "2026-10-27T12:31:37+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T12:33:33+00:00"}]
---

# TRO600 router: unauthenticated arbitrary file read exposes configs and passwords

Hitachi Energy TRO600 series radios/routers: an unauthenticated network attacker can read or download arbitrary files, including configuration and password data (missing authentication, CWE-306). Affected firmware per the CNA record: 9.0.0.0 through 9.1.1.0. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TRO600 affected >= 9.0.0.0, <= 9.1.1.0 fixed ?

## How to check

Check TRO600 firmware version in the device web UI or via SuprOS; versions 9.0.0.0 through 9.1.1.0 are affected. Fixed version: see Hitachi Energy advisory 8DBD000224 (not readable by us).

## Fix

unknown: see Hitachi Energy advisory 8DBD000224; until then restrict management access to the device (no internet exposure, firewall/segment it) and rotate credentials stored on it if exposed.

## Timeline

- 2026-10-27T12:31:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106087
- 2026-10-27T12:33:33+00:00 analyst — Hitachi Energy CNA record (cve.org): TRO600 firmware 9.0.0.0-9.1.1.0 affected, CWE-306, CVSS4 8.7; vendor advisory 8DBD000224 is behind a JS/cookie wall so fixed version and mitigations are unread, nothing marked verified. No exploitation or PoC found.

## Documents

- [advisory] CVE Record CVE-2026-106087 (Hitachi Energy CNA) https://www.cve.org/CVERecord?id=CVE-2026-106087
- [describes] Hitachi Energy Cybersecurity Advisory 8DBD000224 - Multiple vulnerabilities (TRO600) https://publisher.hitachienergy.com/preview?DocumentID=8DBD000224&LanguageCode=en&DocumentPartId=&Action=Launch

## From the sources

TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_