Hitachi Energy CoreTec Products Patched for Critical OS Command Injection and Privilege Escalation Vulnerabilities

Hitachi Energy has issued a security advisory disclosing two vulnerabilities affecting its CoreTec product family, which are deployed worldwide in critical infrastructure environments. The first, CVE-2026-13162, carries a CVSS 3.1 base score of 7.5 (HIGH) and a CVSS 4.0 score of 7.7 (HIGH). It is an OS command injection vulnerability residing in the configuration daemon's time synchronization handler. The daemon constructs shell commands by concatenating user-supplied input without sanitization, allowing authenticated users with certain roles to execute arbitrary system commands with full control over the device.

The second vulnerability, CVE-2026-43284, has a CVSS 3.1 base score of 8.8 (HIGH). It affects the IPsec ESP subsystem (esp4) within the Linux kernel used in CoreTec5. This flaw allows a local unprivileged user to escalate privileges to root by crafting specific ESP encrypted network packets. The exploitation leverages how the kernel handles memory pages during decryption, causing data to be written into memory pages the process does not own, including cached copies of privileged operating system binaries. Execution of one of those binaries triggers the attacker's code with root privileges.

Hitachi Energy states that both vulnerabilities have been fixed. The recommended remediation is to update CoreTec5 to version 5.0.0. For CoreTec4 users, the vendor recommends upgrading to CoreTec5 version 5.0.0. Affected versions include CoreTec5 versions 3.4.0 and prior, and CoreTec4 versions 3.4.0 and prior. The CVEs were reported to CISA by researchers from the Hitachi India R&D Center. The vulnerabilities impact Critical Infrastructure Sectors, specifically the Energy sector, with deployment reported worldwide.