CVE-2026-13162 is an OS command injection (CWE-78) in the configuration daemon of Hitachi Energy's CoreTec transformer condition-monitoring device: because the daemon concatenates unsanitized user-supplied timezone input into a shell command, an authenticated user with certain roles can run arbitrary system commands and take full control of the device; NVD has not, as of 2026-11-07, published its own CVSS score.
Vulnerability summary
CVSS base score
N/A
No NVD score published as of
EPSS score (FIRST)
0.2%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2026-13162 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Hitachi Energy TXpert Hub CoreTec5 / CoreTec4 transformer condition-monitoring device | — | CoreTec5 5.0.0 and prior, CoreTec4 3.4.0 and prior (CoreTec5 fixed in 5.0.0; CoreTec4 has no dedicated fix, Hitachi Energy directs CoreTec4 users to migrate to CoreTec5 5.0.0) |
What does this mean for affected devices?
CVE-2026-13162 (CWE-78, OS command injection) affects the configuration daemon of Hitachi Energy's CoreTec product line. CISA's advisory states: "An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device" and locates the flaw in "the configuration daemon's time synchronization handler, which is responsible for setting the s[ystem clock]" — the daemon constructs a shell command by concatenating user-supplied input without sanitization or validation (CISA ICS Advisory ICSA-26-302-03).
CoreTec (marketed as TXpert Hub CoreTec4/CoreTec5) is a physical digital transformer condition-monitoring and diagnostics device deployed inside or alongside power transformers in substations; CoreTec5 adds built-in networking, wireless and cellular hardware for remote monitoring (Hitachi Energy TXpert Hub). NVD tracks CVE-2026-13162 with status "Deferred" as of 2026-11-04: it records only a CISA-ADP-style score submitted by Hitachi Energy's own PSIRT (source [email protected]) — CVSS v4.0 7.7 (high), vector CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed; CISA's own advisory additionally lists a CVSS v3.1 score of 7.5 for the same vulnerability (NVD, CISA ICS Advisory ICSA-26-302-03).
CISA's advisory, originally released by Hitachi Energy on 2026-10-27 and republished by CISA on 2026-10-29, lists the Energy sector with worldwide deployment, documents a companion CVE in the same bundle — CVE-2026-43284, a bundled Linux-kernel IPsec ESP local-root-escalation flaw affecting CoreTec5 only — and credits "Ritesh Kumar Kalle, Subhojeet Mukherjee, Hishamudeen of the Cybersecurity Research group, Hitachi India R&D Center" with reporting both issues (CISA ICS Advisory ICSA-26-302-03).
Hitachi Energy's remediation is to update CoreTec5 to version 5.0.0; CoreTec4, which has no dedicated patched release, should be migrated to CoreTec5 5.0.0 (CISA ICS Advisory ICSA-26-302-03).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00185 (8.189th percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).
NVD has not finished its own severity analysis. In the meantime, CoreTec operators should update to CoreTec5 5.0.0, restrict the roles that can reach the configuration daemon's timezone-setting function, and treat exposed management interfaces on substation monitoring devices as sensitive attack surface.
Evidence
- The CoreTec configuration daemon's time-synchronization handler concatenates unsanitized user-supplied timezone input into a shell command, letting an authenticated user with certain roles run arbitrary OS commands with full device control (CWE-78). — CISA ICS Advisory ICSA-26-302-03
- TXpert Hub CoreTec4/CoreTec5 is a physical transformer condition-monitoring device deployed in substations; CoreTec5 adds built-in networking/wireless/cellular hardware for remote monitoring. — Hitachi Energy TXpert Hub
- NVD status is "Deferred" with a Hitachi Energy PSIRT-submitted Secondary CVSS v4.0 7.7; no NVD-published Primary score as of 2026-11-04. CISA's advisory separately lists a CVSS v3.1 score of 7.5. — NVD
- Advisory affects the Energy sector worldwide; documents companion CVE-2026-43284 (CoreTec5-only Linux kernel IPsec ESP root escalation); reported by Hitachi India R&D Center researchers; fix is CoreTec5 5.0.0, with CoreTec4 users directed to migrate. — CISA ICS Advisory ICSA-26-302-03
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00185 (8.189th percentile) as of 2026-11-06. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What is CVE-2026-13162?
CVE-2026-13162 is an OS command injection (CWE-78) in the configuration daemon of Hitachi Energy's CoreTec transformer condition-monitoring device: because the daemon concatenates unsanitized user-supplied timezone input into a shell command, an authenticated user with certain roles can run arbitrary system commands and take full control of the device; NVD has not, as of 2026-11-07, published its own CVSS score.
How severe is CVE-2026-13162?
CVE-2026-13162 has no NVD CVSS score published as of 2026-11-10, so this page gives it no severity rating rather than assuming low or high risk.
Is CVE-2026-13162 being actively exploited?
CVE-2026-13162 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 0.18%.
What is affected by CVE-2026-13162?
CVE-2026-13162 affects Hitachi Energy TXpert Hub CoreTec5 / CoreTec4 transformer condition-monitoring device.
Where does this CVE-2026-13162 information come from?
This advisory is based on NVD, CISA ICS Advisory ICSA-26-302-03, Hitachi Energy TXpert Hub, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.
Questions about this page?