CVE-2026-13162

Quick assessment

Affected

Hitachi Energy CoreTec 5

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CoreTec 产品中存在一个操作系统命令注入漏洞，允许拥有特定角色的已认证用户以完全控制权限在设备上执行任意系统命令。该漏洞存在于配置守护进程的时区同步处理程序中，该程序负责设置系统时区。在处理时区配置更新时，该守护进程通过将用户提供的输入直接拼接生成 shell 命令，且未进行任何过滤或验证，从而导致漏洞产生。

CVSS 7.7 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Hitachi Energy	CoreTec 5	3.0.0 ~ 5.0.0	-
Hitachi Energy	CoreTec 4	3.0.0 ~ 3.4.0	-

II. Public POCs for CVE-2026-13162

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-13162

请登录查看更多情报信息。

Other References for CVE-2026-13162 (1)

https://publisher.hitachienergy.com/preview?DocumentID=8DBD000258&LanguageCode=en&DocumentPartId=&Action=Launch

https://www.cve.org/CVERecord?id=CVE-2026-13162

Same Patch Batch · Hitachi Energy · 2026-10-27 · 3 CVEs total

CVE-2026-106087	8.7 HIGH	TRO600 任意文件读取漏洞
CVE-2026-10756	7.7 HIGH	TRO600 端口转发绕过 localhost 访问限制漏洞

IV. Related Vulnerabilities

Same vendor: Hitachi Energy

Same weakness: CWE-78