Hitachi Energy CoreTec CVE-2026-13162

Requires an authenticated session as a user holding one of the specific privileged roles permitted to push time-zone/time-synchronization configuration updates to the CoreTec configuration daemon; the injectable sink is that daemon's time-zone-setting handler. Limiting factors: valid credentials for an eligible role are mandatory (PR:L, not anonymous), exploitation is confined to the affected version ranges (CoreTec 5 3.0.0-5.0.0 and CoreTec 4 3.0.0-3.4.0), and the vendor-assigned AC:H implies some non-trivial condition to trigger - though the description does not state what that condition is, so the exact trigger is not described in the available sources. No end-user UI interaction is required (UI:N).

This is a CWE-78 OS command injection in Hitachi Energy CoreTec 4 and CoreTec 5 reached through the configuration daemon's time-synchronization handler, which concatenates attacker-supplied time-zone input into a shell command without sanitization. The input CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H scores 7.7 and reflects a network-reachable but authenticated (PR:L) flaw with full confidentiality/integrity/availability impact on the device. The vendor marked AC:H, yet the description - plain concatenation of user-supplied input with no sanitization or validation - reads like a low-complexity trigger; this AC:H-versus-description tension should be verified with Hitachi Energy, as it materially affects real-world difficulty. Exploitation status: no public exploit identified at time of analysis, and no EPSS or CISA KEV data was supplied, so there is no evidence of active exploitation. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency priority: real impact is high (authenticated operator can gain full device control, a serious concern in an OT/substation context), but the authentication requirement and the niche deployment footprint temper mass-exploitation risk. Net: a genuine high-severity issue for operators of these specific products, not a mass-internet threat.

An authenticated user holding one of the privileged roles on a CoreTec 4/5 device submits a time-zone configuration update containing shell metacharacters; the configuration daemon builds its time-setting command by concatenating that input and executes the attacker's injected commands with the daemon's privileges, yielding full control of the device. No public exploit code or PoC reference was provided. The network attack vector means this can be driven from the device's management interface by any actor who already has valid low-privileged credentials for an eligible role.