Hitachi Energy CoreTec Product Vulnerable to OS Command Injection and Privilege Escalation
CISA has disclosed two critical vulnerabilities in Hitachi Energy's CoreTec product, enabling authenticated command execution and local privilege escalation.
Hitachi Energy's CoreTec product is facing significant security risks due to two newly disclosed vulnerabilities, according to an advisory from the Cybersecurity and Infrastructure Security Agency (CISA).
One of the critical flaws, identified as CVE-2026-13162, is an OS command injection vulnerability. This flaw resides within the product's configuration daemon, specifically in the time synchronization handler responsible for setting the system timezone. Attackers who authenticate with certain roles can exploit this by crafting malicious input that is concatenated into a shell command without proper sanitization. This allows them to execute arbitrary system commands with full control over the affected device, posing a severe threat to the integrity and availability of the system.
The second vulnerability, CVE-2026-43284, is a 'write-what-where' condition affecting the Linux kernel's IPsec ESP subsystem used in CoreTec5. This vulnerability allows a local, unprivileged user to escalate their privileges to root. The flaw occurs when the kernel processes ESP-encrypted network packets. An attacker can manipulate this process to cause the kernel to decrypt data into memory pages that do not belong to it, including cached copies of privileged operating system binaries. When these compromised binaries are executed, the attacker's injected code runs with root privileges, granting them complete control over the system.
These vulnerabilities impact both CoreTec5 and CoreTec4 product lines. CoreTec5 versions 3.4.0 and prior, as well as version 5.0.0, are affected by CVE-2026-13162 and CVE-2026-43284. CoreTec4 versions 3.4.0 and prior are affected by CVE-2026-13162. The successful exploitation of these issues could lead to significant impacts on the confidentiality, integrity, and availability of the affected industrial control systems, which are deployed worldwide in the energy sector.
Hitachi Energy has acknowledged these vulnerabilities and provided remediation guidance. For CoreTec5, the recommended fix is to update to version 5.0.0. For CoreTec4, users are advised to upgrade to CoreTec5 version 5.0.0. General mitigation factors, such as network segmentation, firewall configurations, and restricting direct internet access for control systems, are also recommended as additional layers of defense.
The OS command injection vulnerability (CVE-2026-13162) carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 7.7 (High), indicating a significant risk. The 'write-what-where' condition (CVE-2026-43284) is rated even higher, with a CVSS v3.1 score of 8.8 (High), highlighting its potential for severe damage.
These findings were reported to CISA by researchers Ritesh Kumar Kalle, Subhojeet Mukherjee, and Hishamudeen from the Cybersecurity Research group at the Hitachi India R&D Center. The disclosure underscores the ongoing need for vigilance in securing industrial control systems, which are critical components of global infrastructure.
Organizations utilizing Hitachi Energy's CoreTec products are urged to apply the available patches and implement recommended security practices to mitigate the risks associated with these vulnerabilities.