OS Command Injection (CVE‑2026‑13162) & Write‑What‑Where (CVE‑2026‑43284) in Hitachi Energy CoreTec Product
What It Is — CISA’s Industrial Control Systems Advisory (ICS‑A‑26‑302‑03) reports two critical flaws in Hitachi Energy’s CoreTec 4 and CoreTec 5 platforms.
- CVE‑2026‑13162 is an OS‑command injection in the configuration daemon’s time‑synchronization handler. Authenticated users with certain roles can inject arbitrary shell commands, gaining full system control.
- CVE‑2026‑43284 is a “Dirty Frag” write‑what‑where condition that permits an attacker to overwrite arbitrary memory locations, also leading to full compromise.
Both vulnerabilities receive a CVSS v3.1 base score of 8.8 (High) and affect CoreTec 5 ≤ 3.4.0, 5.0.0 and CoreTec 4 ≤ 3.4.0. Exploitation would undermine confidentiality, integrity, and availability of the device, potentially impacting the broader energy‑sector control environment. Hitachi Energy has issued mitigation guidance; patches are expected but not yet publicly released.
Affected Products – Hitachi Energy CoreTec 4 (≤ 3.4.0) and CoreTec 5 (≤ 3.4.0, 5.0.0).
Why It Matters for Trust & Control Assurance – The flaws expose gaps in privileged‑access enforcement and secure configuration management, a core control objective that underpins multiple frameworks (e.g., NIST CSF Identify and Protect).
Recommended Actions –
- Apply Hitachi‑provided patches or mitigation steps immediately.
- Restrict the vulnerable roles to the minimum set of users required for operations.
- Enable strict command‑execution logging and monitor for anomalous activity.
- Conduct a configuration‑management audit to verify that only authorized changes are permitted.
Source: CISA Advisory