A vulnerability exists in Hitachi Energy REB500 that allows an authenticated user with the Installer role to access and alter directories outside its scope, resulting in unauthorized modification of configuration files and potential disruption of system operation. The weakness is an Access Control flaw (CWE-267), which enables the installer to read, write, or delete files beyond intended boundaries.

The affected product is the Hitachi Energy REB500 series. The vulnerability applies to the REB500 firmware in unspecified versions; the advisory does not list specific firmware versions, so any current releases of that hardware and firmware remain vulnerable.

With a CVSS base score of 7.4 the issue is high, but the EPSS score being under 1% indicates low exploitation probability. Because the bug requires local authenticated Installer credentials, it is not exploitable remotely, but any compromised or privileged account could abuse the flaw. The vulnerability is not listed in the KEV catalog, so no known active exploits are documented.