A flaw in Hitachi Energy TRO600 Series firmware allows an unauthenticated attacker to read or download any file stored on the device. By exploiting this weakness, an adversary can obtain configuration files and password information, leading to exposure of confidential data. The weakness falls under improper authorization and can be leveraged without needing credentials.

The vulnerability affects devices running Hitachi Energy TRO600 Series firmware. No specific firmware version numbers are listed; all impacted units running this firmware are potentially exposed.

With a CVSS score of 8.7, the vulnerability is considered high severity. The EPSS score is not available, and the issue is not currently listed in CISA’s KEV catalog. The attack vector is inferred to be network‑based, likely involving the device’s management interface. Because the flaw is unauthenticated, any network‑connected attacker could read sensitive files, making the risk of data compromise significant.