Skip to content

Back to the catalog

cisa.govadvisory

Hitachi Energy CoreTec Product

CISA advisory ICSA-26-302-03, republished from Hitachi Energy PSIRT 8DBD000258, covers OS command injection (CVE-2026-13162) and the Dirty Frag vulnerability (CVE-2026-43284) in Hitachi Energy CoreTec. CoreTec5 up to 3.4.0 and 5.0.0 are affected by both, and CoreTec4 up to 3.4.0 by CVE-2026-13162. The advisory was released 27 October 2026 and lists generic ICS mitigations. SSVC rates exploitation as none.

TL;DR CISA republishes a Hitachi Energy advisory on command injection and Dirty Frag flaws in CoreTec4 and CoreTec5.
Open original ↗

Organisations named here

  • CISA
  • CWE-78
  • Hitachi Energy PSIRT 8DBD000258
  • ICSA-26-302-03

CVEs named here

  • CVE-2026-13162
  • CVE-2026-43284

Technologies named here

  • SSVC
  • Common Security Advisory Framework (CSAF)
  • Hitachi Energy CoreTec
  • Hitachi Energy CoreTec4 versions <=3.4.0 (CVE-2026-13162)
  • Hitachi Energy CoreTec5 versions <=3.4.0 and 5.0.0 (CVE-2026-13162, CVE-2026-43284)

Techniques named here

  • OS Command Injection
  • Dirty Frag
  • Network segmentation with firewalls
  • VPN for remote access

Related in Hardware & RF