CVE-2026-13162Published

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time syn…

Exact source revision recorded 27 Oct 2026 13:09:22 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-13162

Published

CoreTec 5

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Hitachi Energy",
                    "product": "CoreTec 5",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.0.0",
                            "lessThanOrEqual": "5.0.0",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

CoreTec 4

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Hitachi Energy",
                    "product": "CoreTec 4",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.0.0",
                            "lessThanOrEqual": "3.4.0",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON