[ CVE-2026-13162 · Published 27 Oct 2026 ]
Vulnerability in Hitachi Energy CoreTec 5
CVSS 7.7
EPSS <1%No fix listed yet
[ Description ]Official description
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.