CISA 2026-10-06

Hitachi Energy REB500

Machine-generated analysis · WAYSCloud LLM

REB500 versions 8.3.3.1 and earlier are vulnerable to denial-of-service via libexpat flaws.

Context

The advisory concerns Hitachi Energy REB500 devices, specifically firmware versions 8.3.3.1 and earlier. Two libexpat vulnerabilities (CVE-2024-8176 and CVE-2025-59375) can be triggered by crafted IEC 61850 messages, leading to denial-of-service or memory-corruption. The vendor offers a remediation by updating to firmware version 8.3.4.0.

Operator considerations

Check inventory for REB500 units running version 8.3.3.1 or earlier.
Patch those units to firmware version 8.3.4.0 as provided by Hitachi Energy.
If patching cannot be performed immediately, isolate the REB500 devices from untrusted networks.
Log IEC 61850 parsing failures or unexpected restarts that may indicate exploitation attempts.

From Cybersecurity and Infrastructure Security Agency ↗

Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

The following versions of Hitachi Energy REB500 are affected:

REB500 vers:REB500/

Read the full advisory on CISA →