The historian as a gateway: hardcoded credentials in the power grid's openHistorian
The October 13th edition analyzes a recurring problem in industrial networks: legacy components, experimental implementations, and infrastructure equipment that remain active without sufficient visibility. Key cases include remote code execution and hardcoded credentials in openPDC/openHistorian, six vulnerabilities in RTU500 units with unsupported firmware, flaws in N-Tron 700 industrial…
Editorial
More than twenty alerts were generated this week over five days. Three deserve immediate attention. The first: openPDC and openHistorian with hardcoded credentials and unauthenticated remote code execution, CVSS 9.8. The second: Hitachi RTU500 with firmware CMU 11.x or earlier, an end-of-life line that retains vulnerabilities known since 2010. The third: a Murrelektronik reference implementation that exposes industrial data without authentication, which the manufacturer itself has ordered to be decommissioned. In all three cases, the first question is one of inventory: do you know if any of these components are still active on your network?
Vulnerabilities of the week
[CRITICAL] Remote code execution and hardcoded credentials in openPDC and openHistorian
The CISA advisory regarding Grid Protection Alliance openPDC and openHistorian groups six vulnerabilities, two of which have a CVSS score of 9.8. The most severe (CVE-2026-100730) affects the service console: it deserializes a data structure sent by the client. In installations without Windows Authentication, any attacker on the network can reach this function without credentials and execute code under the service account context. The second critical vulnerability (CVE-2026-105278) applies only to the published Docker image: it includes hardcoded administrative credentials in the source code without forcing a change upon the first login. The manufacturer has stated that it will not release a fix for the Docker image and does not recommend using it in production. This is relevant for OT environments that adopted containers as a fast-track deployment method. Rounding out the list: an unauthenticated internal data publisher interface that exposes the complete topology of devices and measurements (CVE-2026-105281), an STTP publisher that is also unauthenticated in its default configuration (CVE-2026-85479), and a Modbus function that allows an authenticated user to perform SSRF to map reachable internal networks (CVE-2026-101022). Finally, CVE-2026-104629 allows a user with access to the host file system to upload arbitrary code via the component loading mechanism. openHistorian is used in electrical grid metering environments; in our experience, this type of process data platform frequently appears as an integration component in generation and transmission facilities in Mexico and LATAM.
Suggested action: Update openPDC to version 2.9.482 or later and openHistorian to version 2.8.585 or later. For installations updated from previous versions, explicitly verify the binding configuration of the internal publisher and STTP publisher interfaces: the manufacturer’s fix only applies the new default value to new installations. Existing installations retain their previous configuration and will not receive the change automatically. Remove all openPDC Docker images from production; the manufacturer will not release a fix for that vector. Restrict the Modbus function via firewall and allow outbound connections only to equipment and ports authorized by operations.
All updates must be validated with the manufacturer beforehand, tested in a controlled environment, and executed in accordance with the organization’s change management and maintenance window processes.
[CRITICAL] Hitachi RTU500 firmware 11.x and earlier: multiple critical flaws with no support available
Dragos reported six vulnerabilities to CISA in the RTU500 CMU firmware, versions 11.x and earlier, a line declared end-of-support. The most serious finding is the combination of two vectors: CVE-2026-8065 allows uploading arbitrary firmware via POST without authentication (CVSS 9.1), and CVE-2026-8066 allows overwriting files in the file system via relative path traversal, also without authentication (CVSS 9.1). Together, they enable persistent modification of the device from the network. CVE-2026-8067 allows an authenticated user to trigger an RTU reboot via the reset endpoint. Added to this is CVE-2010-2965, a vulnerability in the VxWorks WDB debug service that exposes UDP port 17185 and allows reading or modifying memory and executing arbitrary functions. CVE-2014-9195 adds the lack of authentication in a network service that supports command execution via valid protocol traffic, and CVE-2023-46143 allows downloading code without verifying its integrity. Versions 11.x will not receive a fix within that same branch: Hitachi Energy recommends migrating to 12.7.8, 13.9.1, or a later version. The advisory was published by CISA as ICSA-26-279-06. In our experience, the RTU500 frequently appears in facilities within the Mexican energy sector, including legacy equipment that is not always documented in the active inventory.
Suggested action: Prioritize the inventory of all RTU500s in the field and identify their CMU firmware versions. Any equipment with firmware 11.x or earlier should be considered end-of-support and protected through network isolation, OT segment monitoring, and blocking UDP port 17185 from any source that does not require it. Plan the migration to 12.7.8, 13.9.1, or a later version compatible with the installation.
All updates must be validated with the manufacturer beforehand, tested in a controlled environment, and executed in accordance with the organization’s change management and maintenance window processes.
[HIGH] Red Lion Controls N-Tron 700 Series: seven vulnerabilities in industrial switches with persistent factory credentials
CISA published seven vulnerabilities for Red Lion Controls N-Tron 700 Series industrial switches. Together, they allow for credential recovery, configuration modification, firmware uploads, or triggering reboots, depending on the vector and available access level. CVE-2026-39460 exposes usernames and passwords stored in the configuration file, which can be retrieved through the interaction between SNMP and TFTP (CVSS v4.0: 9.3). CVE-2026-33367 allows executing administrative actions via SNMP, such as retrieving the configuration, modifying accounts, or initiating updates. CVE-2026-32645 documents that factory credentials remain enabled after creating other administrative accounts, while CVE-2026-29797 allows transferring firmware without proper verification. CVE-2026-39453 allows an authenticated user to trigger repeated switch reboots via a specific URL. The available fix is to update to firmware 3.11.1 or later; the manufacturer also recommends configuring or disabling SNMP communities and disabling access to the web interface. In our experience, N-Tron switches frequently appear in industrial manufacturing and process networks with legacy infrastructure.
Suggested action: Update firmware to version 3.11.1 or later and also check equipment with bootloader 2.0.6.1 or earlier. While the update is being performed, restrict or disable SNMP communities, disable the web interface if it is not necessary, and allow administration only from authorized stations and segments.
All updates must be validated with the manufacturer beforehand, tested in a controlled environment, and executed in accordance with the organization’s change management and maintenance window processes.
[CRITICAL] Murrelektronik AAS Edge Client: a reference implementation exposed without authentication
Murrelektronik’s aas-edge-client is an Asset Administration Shell reference implementation created for a LNI 4.0 testbed demonstrator. Its REST API listens on all network interfaces on TCP port 18000, does not require authentication, and accepts requests from any source. CVE-2026-94293 allows a remote attacker to read all data exposed by GET endpoints and modify AAS submodels via PATCH requests. Changes are stored locally and forwarded to the central AAS server, so other systems may consume manipulated industrial information. The manufacturer clarifies that the component was never designed for production, affects all versions, and is no longer maintained.
Suggested action: Search for deployments, copies of the source code, and container images of the aas-edge-client. Murrelektronik will not release a fix and recommends discontinuing its use and removing all instances. While removal is being completed, block TCP port 18000 from any unauthorized segment and monitor GET and PATCH requests to the component.
All updates must be validated with the manufacturer beforehand, tested in a controlled environment, and executed in accordance with the organization’s change management and maintenance window processes.
In brief
- lwIP SMTP Client (Savannah) - critical stack overflow (CVSS 9.8): a malicious SMTP server can overwrite the transmission buffer and execute remote code on the embedded device. The fix is available as the patch `patch_125_smtp_txbuf.diff`, incorporated in commit 614420f82c8729d070e01464c0dddb3c9525c772; manufacturers that integrate the component must update it and recompile their firmware or application. (CVE-2026-15340 / ICSA-26-279-02 / INCIBE-2026-709)
- Johnson Controls EasyIO FG - hardcoded credentials and inadequate privilege management: the product is end-of-support and will not receive a fix. The recommended action is to migrate to the EasyIO Neo R1 Series and maintain strict isolation during the replacement. (CVE-2026-27872, CVE-2026-27873 / ICSA-26-279-01 / INCIBE-2026-708)
- Hitachi Energy SOI - code injection via Apache ActiveMQ (CVSS 8.8): An authenticated user can load a remote Spring XML context via Jolokia JMX-HTTP and execute code with service-level privileges. Apply SOI EP2, which updates ActiveMQ to version 5.19.5 and replaces associated components. (CVE-2026-34197 / ICSA-26-279-04 / INCIBE-2026-710)
- Johnson Controls ADVMS - hardcoded cryptographic key in source code: A local attacker with low privileges can analyze the executable and extract sensitive information used by the application. Update to version 3.10 or later. (CVE-2026-34499 / INCIBE-2026-722)
In closing
This week’s edition isn’t just about patches. It’s about components that remain in operation after their support has ended, container images that should never have been used in production, and network equipment whose management interfaces were exposed more than necessary. The priority action is to confirm existence, version, and technical owner. Look for openPDC and openHistorian, identify RTU500 units with firmware CMU 11.x or earlier, check N-Tron 700 switches, and rule out any deployments of the aas-edge-client. When our current inventory cannot answer these questions, the most urgent vulnerability remains a lack of visibility.
The analysis and prioritization expressed in Perímetro are the editorial responsibility of Roberto Manzo. This publication does not replace specific technical advice for your organization.