---
id: "CVE-2026-10756"
kind: "vulnerability"
aliases: ["CVE-2026-10756"]
title: "TRO600 router: authenticated users can reach localhost-only services via port forwarding"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TRO600 Series Firmware", "fixed": [], "affected": ">= 9.0.0.0, <= 9.2.1.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "embedded-device", "hitachi-energy", "infrastructure", "ot", "router", "tro600"]
not_affected_if: ["auth-required"]
published_at: "2026-10-27T12:17:04+00:00"
first_seen_at: "2026-10-27T12:31:37+00:00"
updated_at: "2026-10-27T12:33:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10756", "first_seen_at": "2026-10-27T12:31:37+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T12:33:38+00:00"}]
---

# TRO600 router: authenticated users can reach localhost-only services via port forwarding

The TRO600 device has a flaw that lets a logged-in attacker get around network restrictions and reach services meant to be reachable only from localhost. Through port forwarding, the attacker can talk to locally bound ports, exposing sensitive functions and confidential information and enabling some availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TRO600 Series Firmware affected >= 9.0.0.0, <= 9.2.1.6 fixed ?

## How to check

Check the TRO600 firmware version in the device web UI or Configuration utility. Versions 9.0.0.0 through 9.2.1.6 are affected per the Hitachi Energy CVE record. Review whether untrusted or low-privilege accounts can log in and set up port forwarding.

## Fix

Fix version unknown: the CVE record lists none. Read Hitachi Energy advisory 8DBD000224 for the fixed firmware (a release after 9.2.1.6) and the workarounds.

## Timeline

- 2026-10-27T12:31:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-10756
- 2026-10-27T12:33:38+00:00 analyst — Hitachi Energy CNA record (cveawg) gives affected TRO600 firmware 9.0.0.0-9.2.1.6, CWE-923, vendor advisory 8DBD000224; the advisory page is JS-only and the browser session died, so fix version and workarounds not read. No exploitation or PoC found. Nothing marked verified.

## Documents

- [advisory] CVE-2026-10756 CVE record (Hitachi Energy CNA) https://cveawg.mitre.org/api/cve/CVE-2026-10756
- [advisory] Hitachi Energy Cybersecurity Advisory 8DBD000224 - Multiple vulnerabilities (TRO600) https://publisher.hitachienergy.com/preview?DocumentID=8DBD000224&LanguageCode=en&DocumentPartId=&Action=Launch
- [mentions] CVE Record: CVE-2026-107564 https://www.cve.org/CVERecord?id=CVE-2026-107564

## From the sources

TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_