Cross-site scripting in Hitachi Energy RTU500
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to user input being improperly sanitized.
Why it matters now
EPSS 0.00406 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi Energy | RTU500 | RTU500 series CMU Firmware version 12.0.1 – 12.0.14; RTU500 series CMU Firmware version 12.2.1 – 12.2.11; RTU500 series CMU Firmware version 12.4.1 – 12.4.11; RTU500 series CMU Firmware version 12.6.1 – 12.6.9 ; RTU500 series CMU Firmware version 12.7.1 – 12.7.6; RTU500 series CMU Firmware version 13.2.1 – 13.2.6 ; RTU500 series CMU Firmware version 13.4.1 – 13.4.3 | — | No fix listed | CNA |
- RTU500 VendorHitachi Energy Affected RTU500 series CMU Firmware version 12.0.1 – 12.0.14; RTU500 series CMU Firmware version 12.2.1 – 12.2.11; RTU500 series CMU Firmware version 12.4.1 – 12.4.11; RTU500 series CMU Firmware version 12.6.1 – 12.6.9 ; RTU500 series CMU Firmware version 12.7.1 – 12.7.6; RTU500 series CMU Firmware version 13.2.1 – 13.2.6 ; RTU500 series CMU Firmware version 13.4.1 – 13.4.3 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachienergy:rtu520_firmware:*:*:*:*:*:*:*:* | 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:rtu520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
| cpe:2.3:o:hitachienergy:rtu530_firmware:*:*:*:*:*:*:*:* | 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:rtu530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
| cpe:2.3:o:hitachienergy:rtu540_firmware:*:*:*:*:*:*:*:* | 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:rtu540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
| cpe:2.3:o:hitachienergy:rtu560_firmware:*:*:*:*:*:*:*:* | 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:rtu560:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
- cpe:2.3:o:hitachienergy:rtu520_firmware:*:*:*:*:*:*:*:* Versions 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:rtu520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
- cpe:2.3:o:hitachienergy:rtu530_firmware:*:*:*:*:*:*:*:* Versions 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:rtu530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
- cpe:2.3:o:hitachienergy:rtu540_firmware:*:*:*:*:*:*:*:* Versions 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:rtu540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
- cpe:2.3:o:hitachienergy:rtu560_firmware:*:*:*:*:*:*:*:* Versions 12.0.1 – 12.0.14; 12.2.1 – 12.2.11; 12.4.1 – 12.4.11; 12.6.1 – 12.6.9; 12.7.1 – 12.7.6; 13.2.1 – 13.2.6; 13.4.1 – 13.4.3 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:rtu560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5769
- 2026-10-03 Alias added: GHSA-q94h-2h95-cmhh
References
More Hitachi Energy Rtu520 Firmware vulnerabilities
- TI-2026-01456 IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of… CVSS 4.0HIGH 8.7
- TI-2022-01926 Out-of-bounds write in Hitachi Energy RTU500 series CMU firmware CVSS 3.1HIGH 7.5
- TI-2023-05306 Cross-site scripting in Hitachi Energy RTU500 series CVSS 3.1MEDIUM 6.1
- TI-2023-05305 Cross-site scripting in Hitachi Energy RTU500 CVSS 3.1MEDIUM 6.1
- TI-2026-01455 RTU500 web interface: An unprivileged user can read user management information. CVSS 4.0MEDIUM 5.3
Sources
- CVE-2023-5769 · CVE Program
- CVE-2023-5769 · NVD
- FIRST EPSS
- GHSA-q94h-2h95-cmhh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences