Vulnerability Intelligence Report
CVE-2026-106087
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-306 ↗CWE-306 Missing authentication for critical function
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Hitachi Energy | TRO600 Series Firmware | 9.0.0.0 <= 9.1.1.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Hitachi Energy |
| Reserved | 2026-10-06T15:07:06 |
| Published | 2026-10-27T11:56:54 |
| Last Updated | 2026-10-27T11:56:54 |
Community Chatter & Buzz