Hitachi Energy CoreTec flaws allow commands and local root
Original title: Hitachi Energy CoreTec Product
Authenticated users can inject OS commands, and a local user can reach root through the built-in Linux ESP code.
Hitachi Energy disclosed two flaws in CoreTec used in the energy sector. CVE-2026-13162 lets an authenticated user with certain roles run arbitrary system commands through the unsanitized timezone handler. CVE-2026-43284, in the Linux IPsec ESP code built into CoreTec5, lets a local unprivileged user write into kernel-owned pages and execute injected code as root. CoreTec5 and CoreTec4 versions 3.4.0 and prior are affected; the stated fix is CoreTec5 5.0.0. CISA’s SSVC marks exploitation as none.
- CVE-2026-13162 scores CVSS 7.5 and 7.7, both high.
- CVE-2026-43284 scores CVSS 8.8 and is a write-what-where condition.
- CoreTec4 users are told to upgrade to CoreTec5 5.0.0.
- The ESP component is compiled into the kernel and present at boot.
Impact: Arbitrary system commands or local privilege escalation to root
| Product | Affected | Fixed in |
|---|---|---|
| Hitachi Energy CoreTec5 | 3.4.0 and prior | 5.0.0 |
| Hitachi Energy CoreTec4 | 3.4.0 and prior | CoreTec5 5.0.0 |
- 1.Update CoreTec5 to version 5.0.0.
- 2.Upgrade affected CoreTec4 systems to CoreTec5 5.0.0.
- Vendors
- Hitachi Energy
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-13162 | OS command injection in Hitachi Energy CoreTec time-zone config | 7.7 | — | ||
| CVE-2026-43284 | Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123) | 8.8 | 94% | PoC |
From the original article
5 min read at cisa.govView CSAF Summary Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.