Live › vulnerability › CVE-2026-10756
Go to dashboardThe TRO600 device has a flaw that lets a logged-in attacker get around network restrictions and reach services meant to be reachable only from localhost. Through port forwarding, the attacker can talk to locally bound ports, exposing sensitive functions and confidential information and enabling some availability impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 12:31 UTC. All times on this page are UTC.
Any Hitachi Energy TRO600 series radio or router running firmware 9.0.0.0 through 9.2.1.6. An attacker must already be logged in to the device, and can then use port forwarding to reach services bound to localhost, exposing sensitive functions and data and causing some availability impact. Utility, industrial and OT operators who run TRO600 and give several people or third parties management access should look first. Deployments where only trusted admins can log in are lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| TRO600 Series Firmware | vendor | >= 9.0.0.0, <= 9.2.1.6 | – |
9.0.0.0 through 9.2.1.6 are affected per the Hitachi Energy CVE record9.2.1.6) and the workaroundsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.
This page as .md · .json · in your agent: get_signal("CVE-2026-10756")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.