Auth bypass in Hitachi Energy Tro600 Series Firmware
CVE-2026-106087
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
Vulnerability class: Broken Authentication
Published · last modified .
EPSS exploit prediction
EPSS: 0.002 (16.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 16.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.