This vulnerability (CVE-2026-1773) in Hitachi Energy RTU500 series CMU firmware arises from CWE-184: an incomplete list of disallowed inputs in the IEC 60870-5-104 protocol handling. Specifically, the firmware does not properly handle invalid U-format frames, potentially causing a denial of service condition. The issue manifests only if the IEC 60870-5-104 bi-directional communication feature is enabled. While enabling IEC 62351-3 secure communication mitigates exploitation risk, it does not remediate the underlying vulnerability. The CVSS v4.0 score is 8.7, indicating high severity, with network attack vector, no privileges or user interaction required, and high impact on availability. No patch or official fix is currently documented.

Successful exploitation can cause denial of service on affected RTU500 devices by sending invalid U-format frames over the IEC 60870-5-104 protocol when bi-directional communication is enabled. This could disrupt operational availability of the device. The vulnerability does not affect confidentiality or integrity. The risk is mitigated but not eliminated by enabling IEC 62351-3 secure communication. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. The vendor has not published a remediation advisory or patch. Enabling IEC 62351-3 secure communication is recommended as it mitigates the risk of exploitation but does not fully remediate the vulnerability. Organizations should evaluate the necessity of enabling IEC 60870-5-104 bi-directional functionality and consider disabling it if not required. Monitor vendor communications for future patches or updates addressing this issue.