An authenticated user with low‑level privileges can use the DAC protocol to read and modify directories on Hitachi Energy REB500 devices beyond the authorizations granted to that user. This flaw allows the attacker to compromise data confidentiality and integrity by altering or deleting directory contents without proper authorization.

The vulnerability affects Hitachi Energy’s Relion REB500 line of devices, specifically the firmware that implements the DAC protocol. No additional version details are listed, so all firmware iterations of the REB500 are presumed vulnerable.

The CVSS score of 7.6 indicates high severity, while the EPSS score of <1% suggests that the exploitation probability is low. The vulnerability is not yet listed in the CISA KEV catalog, and the attack vector is inferred to be an authenticated local user with basic privileges, who can gain unauthorized directory access by exploiting the DAC protocol implementation.