Hitachi Energy says it is aware of OS command injection and Dirty Frag vulnerabilities that affect its CoreTec products. The company states that successful exploitation could affect the confidentiality, integrity and availability of the product.
The advisory lists CoreTec5 and CoreTec4 as affected. For both, the affected versions are 3.4.0 and prior. Hitachi Energy says the fix is to update to CoreTec5 version 5.0.0. For CoreTec4, the remediation is to upgrade to CoreTec5 version 5.0.0.
The first vulnerability, CVE-2026-13162, is an OS command vulnerability. According to the advisory, it allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The flaw sits in the configuration daemon's time synchronization handler, which sets the system timezone. The advisory says the daemon builds a shell command by concatenating user-supplied input without sanitization or validation. The advisory lists its CVSS v3.1 base score as 7.5 and its CVSS v4.0 base score as 7.7, both rated high.
The second vulnerability, CVE-2026-43284, affects the IPsec ESP subs