The vulnerability in Hitachi Energy TRO600 firmware lets an authenticated user bypass network access controls, allowing connection to services that are meant to be reachable only from the local machine. By configuring port forwarding, the attacker can interact with locally bound ports, gaining unauthorized access to sensitive functions and confidential data, which also leads to availability issues.

Devices running Hitachi Energy TRO600 Series firmware are affected. No specific firmware version is listed in the advisory, so all versions of the series should be considered vulnerable until a patch is applied.

The CVSS score of 7.7 indicates a high severity for this flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user credential and the ability to enable port forwarding, implying that the attacker must first compromise or obtain legitimate access to the device. Once authenticated, the attacker can exploit the flaw to reach privileged services, exposing sensitive data and potentially disrupting device operations.