CISA 2026-10-29

Hitachi Energy CoreTec Product

Machine-generated analysis · WAYSCloud LLM

CoreTec5 versions ≤3.4.0 and CoreTec4 versions ≤3.4.0 are vulnerable to OS command injection (CVE-2026-13162). Hitachi Energy recommends updating to CoreTec5 version 5.0.0.

Context

The advisory concerns Hitachi Energy’s CoreTec product, specifically CoreTec5 and CoreTec4 releases. It reports an OS command injection vulnerability (CVE-2026-13162) that allows authenticated users with certain roles to execute arbitrary system commands, potentially impacting confidentiality, integrity, and availability. The flaw resides in the configuration daemon’s time-synchronization handler, which builds a shell command from unsanitized timezone input. Hitachi Energy advises upgrading to CoreTec5 version 5.0.0, which also addresses the CoreTec4 issue.

Operator considerations

Check: Verify CoreTec5 and CoreTec4 installations are not running versions ≤3.4.0.
Isolate: Restrict network access to vulnerable CoreTec devices until they are updated.
Patch: Apply the vendor-provided update to CoreTec5 version 5.0.0, which also resolves the CoreTec4 vulnerability.
Log: Monitor the configuration daemon logs for unexpected timezone-related command execution.

From Cybersecurity and Infrastructure Security Agency ↗

Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

The following versions of Hitachi Energy CoreTec Product are affected:

CoreTec5 vers:CoreTec5/

Read the full advisory on CISA →