Hitachi Energy won't patch Dragos-found flaws in end-of-life RTU500 firmware

The tested range and the listed range are different. Dragos's findings were made against firmware 9.x ^[1]. The affected-products line covers every release at or below 11.x ^[5]. The wider range comes from one sentence. Hitachi Energy wrote that "there is a likelihood that the end-of-life versions 11.x and prior are affected by these vulnerabilities" ^[3]. Releases after 9.x, and any older than it, are on the list because of that likelihood statement and not because of reported findings ^[17].

Hitachi Energy says end-of-life versions are no longer maintained with security updates, and it "strongly recommends" moving to a supported release ^[4]. It says those versions lack "many of the security controls and hardening measures that are standard in modern industrial control systems" ^[6]. For a utility, the cost of the upgrade depends on whether a unit on 9.x can take a current release without new hardware. Hitachi's summary does not say ^[4].

Half the CVE list is older than this year ^[14]. CVE-2010-2965 has a number sixteen years older than the three 2026 identifiers ^[16]. Old identifiers on end-of-life firmware match how Hitachi describes the code. It says these versions were built to the requirements and industry practices "that existed at the time of their release" ^[12].

Dragos took the findings to CISA ^[7]. What the record shows is a researcher's disclosure about legacy code. I'd handle it as an asset-lifecycle problem and keep it out of campaign tracking until someone reports exploitation in the wild.

Some units will stay on old firmware until the next outage window. For those, Hitachi's general guidance is the interim plan. Keep the systems physically protected and off direct Internet connections, behind a firewall that separates them from other networks and exposes as few ports as possible ^[9]. The company also tells customers to add defense-in-depth measures alongside the upgrade ^[11].