Hitachi Energy CoreTec flaws allow commands and local root
Authenticated users can inject OS commands, and a local user can reach root through the built-in Linux ESP code.
58
CVE-2026-13162
OS command injection in Hitachi Energy CoreTec time-zone config
- CVSS 4.0
- 7.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CoreTec's configuration daemon builds a shell command from unsanitized user input in its time-zone synchronization handler. An authenticated user with certain roles can send a time-zone update over the network and run arbitrary system commands with full control of the device. No affected or fixed versions are listed.
What to do: Apply Hitachi Energy's update for CVE-2026-13162. No workaround is stated.
| Product | Affected |
|---|---|
| Hitachi Energy CoreTec | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.
- Weakness
- CWE-78
- Vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X