Hitachi Energy CoreTec flaws allow command injection and root
First merged summary.
CISA says CoreTec5 and CoreTec4 through 3.4.0 have two high-severity flaws, with no known exploitation and a fix in CoreTec5 5.0.0.
Hitachi Energy disclosed two vulnerabilities in CoreTec products used in the energy sector. CVE-2026-13162 lets an authenticated user with certain roles run arbitrary system commands through an unsanitized timezone handler. CVE-2026-43284, in Linux IPsec ESP code built into CoreTec5, lets a local unprivileged user write into kernel-owned pages and execute injected code as root. CoreTec5 and CoreTec4 versions 3.4.0 and prior are affected; the stated fix is CoreTec5 5.0.0, including for CoreTec4 users. CISA’s SSVC marks exploitation as none.
- CVE-2026-13162 scores CVSS 7.5 and 7.7, both high.
- CVE-2026-43284 scores CVSS 8.8 and is a write-what-where condition.
- CoreTec5 and CoreTec4 3.4.0 and prior are affected.
- CoreTec4 users are told to upgrade to CoreTec5 5.0.0.
- ESP code is compiled into the kernel and present at boot.
- CISA’s SSVC lists exploitation as none.
Timeline
dated events in the reporting · oldest first- Oct 29, 2026CISA publishes Hitachi Energy CoreTec advisory · CISA Advisories
What each outlet adds
beyond the shared facts- CISA AdvisoriesVersions, CVSS scores, root via built-in ESP, and no known exploitation.
- Vendors
- Hitachi Energy
- Organizations
- CISA
Coverage
oldest first · one row per article · UTC- · 13d ago
CISA AdvisoriesFirst report
Hitachi Energy TRO600 flaws leak files and reach localhost services
An unauthenticated attacker can read configuration and password files; the fixes are 9.1.2.0 and 9.2.2.1.
- · 13d ago
Hitachi Energy CoreTec flaws allow commands and local root
Authenticated users can inject OS commands, and a local user can reach root through the built-in Linux ESP code.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-106087+1 related CVE | Unauthenticated arbitrary file read in Hitachi Energy TRO600 | 8.7 group max | — | ||
| CVE-2026-13162 | OS command injection in Hitachi Energy CoreTec time-zone config | 7.7 | — | ||
| CVE-2026-43284 | Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123) | 8.8 | 94% | PoC |