On October 29, 2026, CISA republished two Hitachi Energy product advisories: ICSA-26-302-02 for the TRO600 series and ICSA-26-302-03 for CoreTec. Hitachi Energy’s PSIRT had released both on October 27. Neither describes an attack in progress. Both describe the kind of weakness that matters a great deal to utilities, because the affected devices sit in the communications layer between substations, field assets and control centers. 

This Blog walks through what is actually in the advisories, where the severity scores mislead, how the flaws could be chained, and what an OT security team should do in the next 30 days. It also covers PCM600, which readers searching for this news often bundle in. PCM600 is not part of the October 29 batch, and the distinction matters for how you prioritize. 

Key takeaways 

• Four vulnerabilities across two product families were disclosed: two in TRO600 (CVE-2026-10756 and CVE-2026-106087 as listed by CISA) and two in CoreTec (CVE-2026-13162 and CVE-2026-43284). 

• Severity is high, not critical. The headline CVSS v3 scores are 7.5 for TRO600 and 8.8 for CoreTec. 

• No known exploitation. At the time of writing, public trackers show neither TRO600 CVE in CISA’s Known Exploited Vulnerabilities catalog, and no public exploit code is indexed. Hitachi’s own SSVC assessment for CoreTec rates exploitation as none. 

• TRO600 has the larger exposure risk. One flaw is an unauthenticated file read that can expose configuration and password data. That is the kind of bug scanners find first. 

• CoreTec4 has no in-place fix. The vendor’s remediation is migration to CoreTec5 version 5.0.0. 

• PCM600 is a separate story. Its most recent advisory dates to spring 2026 and concerns a ZIP path traversal flaw, with the planned fix in PCM600 3.1 SP4. 

What CISA published on October 29, 2026 

CISA’s ICS advisories are verbatim republications of vendor advisories converted from the vendor’s CSAF files. CISA says plainly that it does not vouch for their technical accuracy, and questions go to Hitachi Energy PSIRT. That context is worth keeping in mind when numbers in different feeds do not match, which they do here. 

Both advisories list the energy sector, worldwide deployment, and a Switzerland headquarters for the vendor. The same CISA batch also included a Siemens Mendix SAML advisory (ICSA-26-302-01), which is unrelated. 

TRO600: the vulnerabilities in detail 

The TRO600 series is Hitachi Energy’s family of industrial wireless and cellular routers, commonly used for remote connectivity to distribution automation and other field assets. Devices like this are attractive targets for a simple reason: they are the doorway between a public or carrier network and the equipment behind it. 

Hitachi’s summary says the flaws can be exploited for remote code execution to enable further attacks, as well as disclosure of sensitive information. The individual CVE descriptions are more modest, and understanding the gap between the two is the most useful thing in this advisory. 

CVE-2026-10756: localhost restriction bypass through port forwarding 

An authenticated attacker can get around network access restrictions and reach services that were meant to be reachable only from the device itself. By using port forwarding, the attacker can talk to locally bound ports, gaining access to sensitive functionality and confidential information, with an availability impact as well. 

• Weakness class: CWE-923, improper restriction of a communication channel to intended endpoints. 

• Severity: 7.7 (High) under CVSS 4.0 per the CVE record, with attack complexity rated high and a prerequisite condition required. 

• Affected: firmware from 9.0.0.0 through 9.2.1.6. 

• Why it matters: Many embedded devices run internal management or diagnostic services on 127.0.0.1 and treat that as a security boundary. Once an authenticated user can tunnel to those services, the boundary is gone. 

CVE-2026-106087: unauthenticated arbitrary file read 

The second flaw lets an unauthenticated attacker read or download arbitrary files from the device, including sensitive configuration files and password data. Two points are worth flagging for your records. First, this CVE identifier is printed that way in the CISA summary; verify it against the vendor’s CSAF file before you load it into a ticketing or vulnerability management system, because the number format is unusual. Second, the advisory lists it under the weakness class missing authentication for critical function. 

Affected versions are 9.2.1.6 and prior on the 9.2 branch, and 9.1.1.0 and prior on the 9.1 branch. 

How the two could be chained 

This section is our analysis, not a statement from the vendor or CISA, and no one has published a working chain. 

1. An unauthenticated attacker with network reach to the management interface reads configuration and password files. 

2. Recovered credentials give the attacker an authenticated session. 

3. The authenticated session is used to tunnel to localhost-only services, which is where the “remote code execution” language in the vendor summary plausibly comes from. 

If that sounds familiar, it should. Pre-authentication information disclosure followed by an authenticated privilege step is one of the most common patterns in edge device compromise. The first step is also the only one that needs no foothold at all. 

This is not TRO600’s first appearance 

In November 2024, CISA published ICSA-24-317-02 for the same product line. That advisory covered a command injection flaw in the Edge Computing UI (CVE-2024-41153) and a plain-text profile file issue (CVE-2024-41156). Both were fixed in firmware 9.2.0.5, and the issues were reported by an Idaho National Laboratory CyTRICS researcher. Two advisories on the same platform in two years does not make it unusually weak, but it does tell you the platform is getting real scrutiny, which means more findings are likely. 

CoreTec: command injection and an inherited Linux kernel bug 

CoreTec is a Hitachi Energy product line tagged by CISA to the energy sector. The advisory covers CoreTec4 and CoreTec5 at versions up to 3.4.0, and the two vulnerabilities come from very different places. 

CVE-2026-13162: OS command injection in the time-sync handler 

The configuration daemon’s time synchronization handler, which sets the system timezone, builds a shell command by joining in user-supplied input without cleaning it. An authenticated user with certain roles can therefore run arbitrary commands with full control of the device. 

• Weakness class: CWE-78, OS command injection. 

• Severity: 7.5 under CVSS 3.1 and 7.7 under CVSS 4.0. The vector shows network access, high attack complexity and low privileges required. 

• Affects: CoreTec4 and CoreTec5 up to 3.4.0. 

The timezone field is a textbook example of the “boring input” problem. Nobody expects a dropdown-style setting to be an attack surface, so it often escapes the input validation that the login form received. Defenders should read this as a hint about the codebase: other configuration handlers that build shell strings may exist. 

CVE-2026-43284: the “Dirty Frag” Linux kernel flaw 

This is the more instructive entry. CVE-2026-43284 is one half of a Linux kernel privilege escalation pair publicly disclosed on May 7, 2026 and nicknamed Dirty Frag. The flaw sits in the kernel’s IPsec ESP receive path. Instead of copying incoming data to a fresh buffer before decrypting it, the kernel can decrypt in place, directly inside memory it does not own. A local attacker who sets up the right conditions can cause attacker-chosen bytes to land in the in-memory copy of a privileged binary. The next time that binary runs, the attacker’s code runs as root. 

The CoreTec advisory notes that in CoreTec5 the vulnerable ESP component is compiled directly into the kernel rather than loaded as a module, so it is present from boot. Rated 8.8 under CVSS 3.1 (local access, low complexity, changed scope), it takes a local unprivileged user to root. 

Two observations for security leaders: 

• The patch gap on embedded Linux is measured in months. Public kernel fixes arrived in early May. The vendor’s coordinated advisory for its embedded product arrived in late October. That is not unusual for appliance firmware, but it is the real-world window your risk model should assume. 

• Local-only does not mean low risk. A flaw that needs local access becomes the second stage of any attack that lands code on the device, including the command injection described above. Pair CVE-2026-13162 with CVE-2026-43284 and an authenticated user with a limited role could plausibly go from a timezone setting to unrestricted root. Again, that is our reasoning, not a published exploit chain. 

Remediation for CoreTec 

Update CoreTec5 to version 5.0.0. CoreTec4 owners are directed to upgrade to CoreTec5 5.0.0, with the vendor’s general mitigation factors as the interim measure. In practice that means a platform migration rather than a patch window, and you should start planning it now rather than when an exploit appears. 

What about PCM600? 

PCM600 is Hitachi Energy’s protection and control IED manager, the engineering software used to configure and manage protection relays. It does not appear in the October 29 CISA batch. We include it because it is the third product in the search phrase many readers are using, and because PCM600 has a recent advisory history worth knowing: 

• April 28, 2026 (CISA republication May 5, 2026, ICSA-26-125-01): a ZIP path traversal flaw (CVE-2018-1002208, the known “Zip Slip” issue in the SharpZipLib component). A malicious archive can write files outside the intended extraction directory. CISA scored it 4.4. Affected versions include PCM600 legacy releases up to 2.11 and the 3.x line through 3.1 SP3. The vendor’s planned fix is PCM600 3.1 SP4. 

• Ownership split: ABB continues to maintain PCM600 2.x, while Hitachi Energy maintains and validates only the 3.x line, and warns it cannot vouch for compatibility of ABB’s updates with its own relays. 

• 2022 history: ICSA-22-333-02 covered IED credentials stored in cleartext in the PCM600 database and log files. 

The lesson is not that PCM600 is under attack. It is that engineering workstations hold the keys to protection relays, and they have been neglected in many programs. A flaw rated medium on paper in software that touches protection settings deserves a higher internal priority than its score suggests. 

Why the CVSS numbers need context 

A 7.5 or 8.8 does not tell you how worried to be. Compare the evidence: 

Our read: the unauthenticated TRO600 file read is the finding most likely to be scanned for, while the CoreTec flaws matter most in combination and in post-compromise scenarios. Patch order should follow exposure, not just score. 

Is anyone exploiting these? Who is behind it? 

There is no attacker to name. These are disclosure advisories. The TRO600 flaws were reported by Hitachi Energy’s internal team, and the CoreTec flaws by the cybersecurity research group at Hitachi India R&D Center. As of October 30, 2026, we found no public reports of exploitation of the four CVEs in these advisories, and neither TRO600 CVE appears in the KEV catalog. 

Treat that as a snapshot. The Dirty Frag technique itself has been public since May, and Microsoft published guidance on it in an active-attack framing on May 8, so the building blocks for the CoreTec kernel flaw are not secret. Absence of reported exploitation is not evidence of absence, particularly for devices that rarely forward logs to a central platform. 

Impact on utilities and substation operators 

What could go wrong if these were exploited against a utility network? 

• Credential exposure at scale. Router configuration files often contain VPN keys, SNMP strings and shared secrets reused across a fleet. One unauthenticated read can unlock many sites. 

• Loss of remote connectivity. The advisories cite availability impact. Losing a router at a remote substation means losing visibility and control, and truck rolls. 

• Pivot into protection and control networks. A compromised communications device is a launch point toward IEDs, RTUs and, through engineering workstations running tools like PCM600, protection settings. 

• Compliance exposure. Utilities under NERC CIP or comparable regimes must show patch evaluation and mitigation timelines for devices in scope. These advisories start that clock. 

A prioritized remediation plan 

1. Build the inventory first (days 1 to 3). Identify every TRO600 unit with its firmware version, every CoreTec4 and CoreTec5 device with its version, and every PCM600 install including engineering laptops. If you cannot list them, that is your first finding. 

2. Remove exposure (days 1 to 7). Confirm that TRO600 management interfaces are not reachable from the internet, carrier networks or flat corporate networks. Restrict management access to a jump host with multifactor authentication. 

3. Patch TRO600 (days 7 to 30). Move to 9.2.2.1, or 9.1.2.0 at minimum if you are held on the 9.1 branch. Test in a lab first; firmware changes on radios can alter routing and failover behavior. 

4. Rotate credentials after patching. Because the file-read flaw exposes password data, assume stored secrets on unpatched, reachable units may have been read. Rotate passwords, keys and shared secrets, and do it after the patch so new secrets are not immediately exposed. 

5. Plan the CoreTec move (days 14 to 60). Schedule CoreTec5 5.0.0 upgrades and begin the CoreTec4 migration project. Limit which roles can change device configuration in the interim. 

6. Tighten engineering workstations. Move PCM600 hosts to 3.x, track the 3.1 SP4 release, and scan archives before they are opened with the software. 

7. Document compensating controls. Where you cannot patch inside your window, record firewall rules, access restrictions and monitoring that cover the gap. 

Do not strip or blacklist kernel modules on vendor appliances yourself as a Dirty Frag workaround. Public guidance for general Linux servers suggests disabling the ESP modules, but that can break IPsec, and on a sealed appliance it also voids support. Follow the vendor’s firmware path. 

Detection ideas for your SOC 

• Alert on web requests to TRO600 management interfaces from any address outside your management range, and on unusually large or repeated file downloads from them. 

• Watch for configuration changes that add port-forwarding rules on field routers. 

• Log and review timezone or time-sync configuration changes on CoreTec devices, especially values containing shell characters such as semicolons, backticks or dollar signs. 

• Baseline the user accounts and roles that can change configuration, and flag use outside maintenance windows. 

• Where devices support syslog, forward it. Many incidents on edge devices are discovered late simply because nothing was collecting logs. 

The larger pattern 

Three themes stand out across these advisories. 

First, third-party components age badly in OT. PCM600’s issue stems from a library flaw first catalogued in 2018. CoreTec inherits a Linux kernel bug from 2026. Your software bill of materials, if you have one, should be the starting point for these questions. 

Second, vendors are publishing more. Hitachi Energy advisories appear on CISA’s list repeatedly across recent months, including SOI, Asset Suite and REB500 in early October. More disclosure is a sign of a maturing program, and also a workload your team must absorb. 

Third, the communications layer is the soft middle. Everyone hardens the controller and the SCADA server. Routers, switches and engineering laptops get less attention and carry the credentials that matter. 

Frequently asked questions 

Are the Hitachi Energy TRO600 vulnerabilities critical? They are rated high severity. The headline CVSS v3 score is 7.5, and the CVE record for the localhost bypass lists 7.7 under CVSS 4.0. 

Which TRO600 firmware versions fix the issues? Version 9.2.2.1 is the recommended update. On the 9.1 branch the fix is in 9.1.2.0. 

What is CVE-2026-43284 and why is it in CoreTec? It is the ESP page-cache flaw in the Linux kernel known as Dirty Frag. CoreTec5 includes the vulnerable code compiled into its kernel, so the product inherits the issue. 

Is there a patch for CoreTec4? The vendor’s remediation is to upgrade to CoreTec5 5.0.0. Until then, follow the general mitigation factors in the advisory. 

Is PCM600 affected by the October 29 advisories? No. PCM600’s latest advisory in our research is the ZIP path traversal issue published in April and May 2026. 

Have these vulnerabilities been exploited? We found no public reports of exploitation as of October 30, 2026. 

How Shieldworkz can help 

Advisories like these land weekly, and most OT teams struggle with the same three questions: which of these devices do we actually run, which are reachable, and what do we fix first. Shieldworkz works with utilities and industrial operators on asset visibility, OT vulnerability prioritization, network segmentation and incident readiness. If you want help mapping this advisory batch to your environment, get in touch with our team.