{"id":"CVE-2026-10756","kind":"vulnerability","aliases":["CVE-2026-10756"],"related":[],"title":"TRO600 router: authenticated users can reach localhost-only services via port forwarding","description":"TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.","summary":"The TRO600 device has a flaw that lets a logged-in attacker get around network restrictions and reach services meant to be reachable only from localhost. Through port forwarding, the attacker can talk to locally bound ports, exposing sensitive functions and confidential information and enabling some availability impact.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TRO600 Series Firmware","fixed":[],"affected":">= 9.0.0.0, <= 9.2.1.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","embedded-device","hitachi-energy","infrastructure","ot","router","tro600"],"not_affected_if":["auth-required"],"how_to_check":"Check the TRO600 firmware version in the device web UI or Configuration utility. Versions 9.0.0.0 through 9.2.1.6 are affected per the Hitachi Energy CVE record. Review whether untrusted or low-privilege accounts can log in and set up port forwarding.","fix":"Fix version unknown: the CVE record lists none. Read Hitachi Energy advisory 8DBD000224 for the fixed firmware (a release after 9.2.1.6) and the workarounds.","status":"open","published_at":"2026-10-27T12:17:04+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","triaged_at":"2026-10-27T12:32:02+00:00","updated_at":"2026-10-27T12:33:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T12:32:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TRO600 router: authenticated users can reach localhost-only services via port forwarding","impact":"medium","summary":"The TRO600 device has a flaw that lets a logged-in attacker get around network restrictions and reach services meant to be reachable only from localhost. Through port forwarding, the attacker can talk to locally bound ports, exposing sensitive functions and confidential information and enabling some availability impact.","category":"infrastructure","nicknames":[],"who_cares":["tro600","embedded-device"],"confidence":0.5,"needs_auth":"yes","worst_case":"authenticated attacker reads confidential data and reaches localhost-only services","analyst_note":"Find the vendor advisory and affected firmware versions for TRO600; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-10756 does not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000528,"input_tokens":3344,"output_tokens":387,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected firmware versions for TRO600; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-10756 does not list them.","search":"'-10756':16A,19A '-2026':15A,18A 'access':97C,100C,126C 'allow':90C 'around':50B 'attack':48B,67B,93C,114C 'auth':24B 'auth-requir':23B 'authent':3A,92C 'avail':83B,135C 'bound':72B,119C 'bypass':95C 'caus':134C 'confidenti':78B,131C 'contain':86C 'cve':14A,17A 'devic':28B,38B 'embed':27B 'embedded-devic':26B 'enabl':81B 'energi':31B 'expos':74B 'firmware':22A 'flaw':41B 'forward':13A,65B,112C 'function':76B,129C 'get':49B 'hitachi':30B 'hitachi-energi':29B 'impact':84B,136C 'inform':79B,132C 'infrastructur':32B 'intend':102C 'interact':116C 'let':43B 'leverag':110C 'local':71B,118C 'localhost':8A,62B,108C 'localhost-on':7A 'log':46B 'logged-in':45B 'meant':56B 'network':51B,96C 'ot':33B 'port':12A,64B,73B,111C,120C 'reach':6A,54B 'reachabl':59B,105C 'requir':25B 'restrict':52B,98C 'result':123C 'router':2A,34B 'sensit':75B,128C 'series':21A 'servic':10A,55B,101C,122C 'talk':69B 'tro600':1A,20A,35B,37B,85C 'unauthor':125C 'user':4A 'via':11A 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Any Hitachi Energy TRO600 series radio or router running firmware 9.0.0.0 through 9.2.1.6. An attacker must already be logged in to the device, and can then use port forwarding to reach services bound to localhost, exposing sensitive functions and data and causing some availability impact. Utility, industrial and OT operators who run TRO600 and give several people or third parties management access should look first. Deployments where only trusted admins can log in are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cybersecurity@hitachienergy.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10756","severity":null,"published_at":"2026-10-27T12:17:04+00:00","modified_at":"2026-10-27T12:17:04+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","fetched_at":"2026-10-27T12:31:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10756:873","url":null,"severity":null,"published_at":"2026-10-27T12:33:38+00:00","modified_at":"2026-10-27T12:33:38+00:00","first_seen_at":"2026-10-27T12:33:38+00:00","fetched_at":"2026-10-27T12:33:38+00:00","note":"Hitachi Energy CNA record (cveawg) gives affected TRO600 firmware 9.0.0.0-9.2.1.6, CWE-923, vendor advisory 8DBD000224; the advisory page is JS-only and the browser session died, so fix version and workarounds not read. No exploitation or PoC found. Nothing marked verified."}],"documents":[{"id":2628,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107564","title":"CVE Record: CVE-2026-107564","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":6306,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-10756","title":"CVE-2026-10756 CVE record (Hitachi Energy CNA)","kind":"advisory","source":"analyst","text":"Hitachi Energy CNA record, published 2026-10-27. Affected: TRO600 Series Firmware 9.0.0.0 through 9.2.1.6 (custom range). CWE-923. CVSS 4.0 7.7 High, AV:N/AC:H/AT:P/PR:L. Reference: Hitachi Energy advisory 8DBD000224. No fix version in the record.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":6305,"url":"https://publisher.hitachienergy.com/preview?DocumentID=8DBD000224&LanguageCode=en&DocumentPartId=&Action=Launch","title":"Hitachi Energy Cybersecurity Advisory 8DBD000224 - Multiple vulnerabilities (TRO600)","kind":"vendor","source":"analyst","text":"Vendor advisory referenced by the CVE record; page title says Multiple vulnerabilities. Body could not be retrieved.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}