---
id: CVE-2026-8067
title: >-
  An improper authorization vulnerability in the end-of-life versions of
  RTU500’s web application allows an authenticated user to trigger the RTU500 to
  reboot through the reset endpoint
summary: >-
  An improper authorization vulnerability in the end-of-life versions of
  RTU500’s web application allows an authenticated user to trigger the RTU500 to
  reboot through the reset endpoint. Successful exploitation could cause
  temporary device…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-862
vendor: Hitachi Energy
product: RTU500 series CMU firmware
affected:
  - rtu500_series_cmu_firmware >= 9.0 < 12.0
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T21:39:02.570'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8067'
references:
  - url: >-
      https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch
    label: cybersecurity@hitachienergy.com
tags:
  - nvd
  - cve.org
epss: 0.00228
epssPercentile: 0.13562
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-29T15:04:54.700468Z'
ingestedAt: '2026-09-29T10:31:36.315Z'
---

## Overview

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.