Hitachi Energy RTU500 Missing Authentication for Critical Function (CVE-2026-8065)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506491);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/27");

  script_cve_id("CVE-2026-8065");
  script_xref(name:"ICSA", value:"26-279-06");

  script_name(english:"Hitachi Energy RTU500 Missing Authentication for Critical Function (CVE-2026-8065)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An authentication bypass vulnerability in the firmware update endpoint
of Hitachi Energy RTU500 allows an unauthenticated attacker to upload
arbitrary firmware through a crafted POST request. Successful
exploitation could allow the attacker to modify device functionality
or compromise the integrity or availability of the device.

According to Hitachi Energy, RTU500 series CMU firmware versions 11.x
and prior are affected. All affected versions are End-of-Life.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eddc4cc3");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06");
  script_set_attribute(attribute:"solution", value:
"Upgrade the RTU500 series CMU firmware to a supported version (12.7.8,
13.9.1 or later) as recommended in the Hitachi Energy advisory, and
apply the general mitigation factors described in the advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-8065");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(306);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu500_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:hitachienergy:rtu500_firmware" :
        {"versionEndExcluding" : "12.0.0", "family" : "AbbRTU500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);