TI-2026-81136 Aliases CVE-2026-13162 GHSA-qf5f-cpcv-rc7c

OS command injection in Hitachi Energy CoreTec products

LOW 35CWE-78Published 2026-10-27 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Hitachi Energy CoreTec 5 from 3.0.0 through 5.0.0 and CoreTec 4 from 3.0.0 through 3.4.0 are affected. The configuration daemon's time-zone handler builds a shell command from user input without sanitization or validation, which is an OS command injection flaw (CWE-78). An authenticated user with certain roles can run arbitrary system commands with full control over the device.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00185 8th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hitachi Energy	CoreTec 5	3.0.0 – 5.0.0	—	No fix listed	CNA
Hitachi Energy	CoreTec 4	3.0.0 – 3.4.0	—	No fix listed	CNA

CoreTec 5 VendorHitachi Energy Affected 3.0.0 – 5.0.0 Fixed in — No fix listed CNA
CoreTec 4 VendorHitachi Energy Affected 3.0.0 – 3.4.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Hitachi Energy CoreTec 5 or CoreTec 4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

2026-10-27 Threatist record created from CVE-2026-13162
2026-10-27 Alias added: GHSA-qf5f-cpcv-rc7c
2026-10-28 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed

References

Other 1

https://publisher.hitachienergy.com/preview?DocumentID=8DBD000258&LanguageCode=en&DocumentPartId=&Action=Launch

TI-2019-03985 ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
TI-2018-10635 Improper authentication in ICS-CERT ABB eSOMS CVSS 3.0CRITICAL 9.8
TI-2024-01871 Heap-based buffer overflow in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
TI-2026-07105 Path traversal in Hitachi Energy RTU500 series CMU firmware CVSS 3.1CRITICAL 9.1
TI-2019-13270 Path traversal in Relion 670 Series CVSS 3.1CRITICAL 10.0
TI-2026-07104 Missing authentication in Hitachi Energy RTU500 series CMU firmware CVSS 3.1CRITICAL 9.1

See all 146 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences