VulnSocial

CVE-2026-13162

LOWCVSS 7.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-29: 210-29
Referenced assets2 URLs
Full discourse2 posts
  • Aviatrix Threat Research Center@aviatrixtrc

    Attackers can chain two flaws in Hitachi Energy CoreTec to go from low-privileged access to full root control of OT security appliances governing critical energy infrastructure. CVE-2026-13162 enables OS command injection via the timezone handler; CVE-2026-43284 escalates to root through a kernel IPsec ESP write-what-where condition. Runtime segmentation can restrict internal pivoting after a device is rooted — limiting how far an attacker reaches across the OT network. #CloudSecurity #ThreatIntel 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/icsa-26-302-03-hitachi-energy-coretec-cve-2026-13162-cve-2026-43284

    0000063
    2.0K followersView on X
  • DuckButTurttle@DuckButTurttle

    Hitachi Energy CoreTec 4/5 transformer monitoring units have an OS command injection (CVE-2026-13162) and the "Dirty Frag" Linux LPE (CVE-2026-43284), giving an authenticated user full device control. Fixed in CoreTec5 5.0.0. Source: CISA https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03

    00000151
    15 followersView on X

Explore more

Back to dashboard