CVE-2026-8479

published 2026-05-26

CVE-2026-8479: IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a…

Priority P4 28 medium 6.9 CVSS 4.0

AV A AC L AT N PR L UI N VC N VI N VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable
for a NULL pointer dereferencing, if a specially crafted
sequence of messages is sent for a certain time, causing
Denial of Service impact.
Product is only affected if IEC 60870-5-104 functionality in
bidirectional mode (BCI) is configured.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
hitachi_energy	rtu500_series_cmu_firmware	—	—
hitachi_energy	rtu500_series_cmu_firmware	12.7.1 – 12.7.7	—
hitachi_energy	rtu500_series_cmu_firmware	13.5.1 – 13.5.4	—
hitachi_energy	rtu500_series_cmu_firmware	13.6.1 – 13.6.3	—
hitachi_energy	rtu500_series_cmu_firmware	13.7.1 – 13.7.8	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476