Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Industrial control advisorySeverity 4.4 medium

Hitachi Energy PCM600 (Update A)

ICSA-26-125-01 · CISA · April 28, 2026

Summary

Hitachi Energy is aware of a vulnerability that affects the Hitachi Energy PCM600 product versions listed in this document. An attacker successfully exploiting this vulnerability can impact integrity of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

From CISA, quoted as published. Check the source before acting.

What to do

Please see the PCM600 Legacy Versions section below Ensure that Chapter 4 of Cyber Security Deployment Guideline - 1MRK505410 has been followed during the deployment. Ensure that no default credentials are in use. In case of exceptions, please ensure they have been mitigated with adequate countermeasures. Update to PCM600 3.1 SP4

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2018-10022084.4 mediumNo9.9%Improper Limitation of a Pathname to a Restricted Directory (CWE-22)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
Hitachi EnergyPCM600 Legacyvers:PCM600_Legacy/<=2.11—
Hitachi EnergyPCM6003.0, 3.0_HF1, 3.0_HF2, 3.0_HF3, 3.1, 3.1_SP1, 3.1_SP2, 3.1_SP33.1_SP4

Why it's on these mode pages

  • Maritime: Vendor table: Hitachi Energy (industrial control makers used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Hitachi Energy (industrial control makers used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Hitachi Energy (industrial control makers used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Hitachi Energy (industrial control makers used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Hitachi Energy (industrial control makers used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Hitachi Energy (industrial control makers used in every mode, all modes) (matched by rule)

Change history

  1. April 28, 2026: Initial public release
  2. May 5, 2026: CISA Republication - Initial CISA Republication of Hitachi Energy 8DBD000239 advisory
  3. October 27, 2026: Remediation released in PCM600 v3.1 SP4 on 16-09-2026
  4. October 29, 2026: CISA Republication update based on Hitachi Energy PSIRT 8DBD000239 advisory
  5. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com