CVE-2026-17539CWE-476

CVE-2026-17539

Medium · published September 3, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.7th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-09-03T17:04Z
References (1)
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000259&LanguageCode=en&DocumentPartId=&Action=Launch · [email protected]
EPSS history
Timeline
  • 04 SEP 03:38Z
    EPSS moved — → 0%
    epss
  • 03 SEP 07:59Z
    RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry…
    cvelistv5