OS Command Injection Vulnerability in CoreTec Product by Hitachi Energy
CVE-2026-13162

7.7HIGH

Key Information:

Vendor

Hitachi
Status
Coretec 5
Coretec 4
Vendor
CVE Published:
27 October 2026

What is CVE-2026-13162?

An OS command injection vulnerability has been identified in the CoreTec product developed by Hitachi Energy. This flaw permits authenticated users with specific roles to execute arbitrary system commands on the device, thereby gaining full control. The issue arises in the configuration daemon's time synchronization handler, responsible for managing system time zones. By improperly handling user-supplied input during time zone configuration updates, the daemon constructs shell commands without sufficient sanitization or validation, exposing the system to potential exploitation.

Affected Version(s)

CoreTec 4 3.0.0 <= 3.4.0

CoreTec 5 3.0.0 <= 5.0.0

References

https://publisher.hitachienergy.com/preview?DocumentID=8D...

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.