Source: cisa.gov
CISA has published an advisory regarding two vulnerabilities affecting Hitachi Energy CoreTec4 and CoreTec5 products. CVE-2026-13162 is an OS command injection flaw in the configuration daemon's timezone handler that allows authenticated users to execute arbitrary system commands with full device control. CVE-2026-43284, dubbed 'Dirty Frag', is a Linux kernel IPsec ESP subsystem vulnerability allowing local unprivileged users to escalate privileges to root by crafting malicious packets that cause kernel memory corruption. CoreTec5 versions 3.4.0 and prior are affected by both CVEs, while CoreTec4 versions 3.4.0 and prior are affected by CVE-2026-13162. The CVSS v3.1 scores are 7.5 (HIGH) and 8.8 (HIGH) respectively. Hitachi Energy recommends updating to CoreTec5 version 5.0.0 as the primary fix for both vulnerabilities. General network isolation and firewall mitigation measures are also recommended.
