Hitachi Energy warns of two flaws in CoreTec network products
Hitachi Energy says its CoreTec 4 and CoreTec 5 products contain a command injection flaw, and CoreTec 5 also a Linux flaw. Operators should follow the vendor's recommended actions.
Written by the SecurityTabs AI newsroom from the original post by CISA Advisories; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Hitachi Energy says it is aware of an OS command injection flaw and a Linux flaw known as Dirty Frag affecting its CoreTec product. It says successful exploitation could affect confidentiality, integrity and availability of the product. CISA republished the advisory on 2026-10-29. [1]
Affected are CoreTec 5 versions up to 3.4.0 and 5.0.0, which carry CVE-2026-13162 and CVE-2026-43284, and CoreTec 4 versions up to 3.4.0, which carry CVE-2026-13162. NVD rates CVE-2026-13162 at 7.7 under CVSS 4.0 and CVE-2026-43284 at 8.8 under CVSS 3.1. [1]
FIRST's exploitation prediction score for CVE-2026-43284 is 0.942. Hitachi Energy directs customers to the Recommended Immediate Actions section of its advisory for mitigation and remediation. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- WeaknessCommand injectionGetting an application to run operating-system commands built from attacker input.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]CISA Advisories
Hitachi Energy CoreTec Product