> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Hitachi CoreTec5 OS command injection and Dirty Frag flaws disclosed
- URL: https://f4n6.co.uk/security-feed/hitachi-coretec5-os-command-injection-and-dirty-frag-flaws-disclosed/
- Published: 2026-10-29T15:54:22.000Z
- Updated: 2026-10-29T15:54:22.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Hitachi Energy has published PSIRT advisory 8DBD000258, republished verbatim by CISA as ICSA-26-302-03, covering two vulnerabilities in the CoreTec product line: an OS command injection flaw (CVE-2026-13162) affecting CoreTec5 up to and including 3.4.0 and 5.0.0, and a write-what-where condition described as "Dirty Frag" (CVE-2026-43284) affecting CoreTec5 only. Hitachi Energy rates the combined issue CVSS v3 8.8 (high). No CVSS vector, CWE mapping, EPSS score or CISA KEV entry is available for either CVE, and CISA's SSVC assessment records exploitation as none and technical impact as none as of 2026-10-26\. The exposure for EMEA financial services is indirect but real: CoreTec equipment sits in the energy and utility estate that bank branches, data centres and payment operations depend on, so a compromise of the device is a third-party and continuity problem before it is a malware problem. There is no public proof-of-concept, no observed exploitation and no named threat actor in the source material.

## 2\. Regulatory framing

| Article            | Trigger (the fact in this item)                                                                                                                                          | Practical impact                                                                                                                                                                       |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28       | CoreTec5 and CoreTec4 are ICT third-party hardware/software supplied by Hitachi Energy, and the advisory gives no patch version, only a general mitigation section       | Firms must confirm the Hitachi Energy contract carries vulnerability disclosure and remediation-timeline obligations, and obtain the fixed firmware version in writing from the vendor |
| DORA Art. 29       | CoreTec equipment is deployed worldwide in the energy sector, so a firm's utility or facilities provider may run the same affected versions across shared infrastructure | Where CoreTec underpins power delivery to owned or outsourced sites, assess concentration risk: how many sites depend on one vendor's affected product line                            |
| NIS2 Art. 21(2)(d) | The flaw is in a supplier product and the vendor advisory supplies no version-specific fix, leaving the mitigation to the customer's own network controls                | Entities in scope must evidence supply chain security measures for this supplier, including a documented compensating-control decision while no patch exists                           |

## 3\. Technical analysis & attack chain

The source material is a vendor disclosure with no exploitation reporting, no proof-of-concept and no attack telemetry. What follows is limited to what Hitachi Energy and CISA state.

1. An attacker reaches a CoreTec5 or CoreTec4 device. The advisory does not describe the access path, the exposed interface, or whether authentication is required.
2. On CoreTec5 (versions up to and including 3.4.0 and 5.0.0) and CoreTec4 (up to and including 3.4.0), the attacker exploits CVE-2026-13162, an OS command injection (improper neutralization of special elements used in an OS command), to run commands on the device.
3. On CoreTec5 only, the attacker exploits CVE-2026-43284, a write-what-where condition Hitachi Energy names "Dirty Frag", to write controlled values to arbitrary memory.
4. Hitachi Energy states successful exploitation could affect confidentiality, integrity and availability of the product. It does not describe what data is exposed, what configuration can be altered, or whether the device can be taken offline.

The two flaws are listed together under a single CVSS v3 score of 8.8\. The advisory does not break the score down per CVE, does not give a CVSS vector string, and does not assign CWE identifiers beyond the two weakness names in the vulnerability list. CISA's SSVC block reads `SSVCv2/E:N/A:N/2026-10-26T15:17:24Z/`, meaning exploitation none and technical impact none at the time of assessment. That assessment predates public disclosure and should not be read as a statement that the flaws are hard to exploit.

The "Dirty Frag" label and the write-what-where classification come only from the Hitachi Energy advisory as republished by CISA. No independent analysis of the memory-corruption primitive, no crash details and no exploitation constraints are available. Treat the mechanism as single-sourced until a researcher publication or the vendor's own CSAF document adds detail.

Affected versions, verbatim from the advisory: CoreTec5 `vers:CoreTec5/<=3.4.0, 5.0.0` (both CVEs); CoreTec4 `vers:CoreTec4/<=3.4.0` (CVE-2026-13162 only). The version string lists 5.0.0 alongside the `<=3.4.0` range, which reads as 5.0.0 being affected as a discrete version rather than the range extending to it. Confirm the exact affected build with Hitachi Energy before assuming a 5.0.x device above 5.0.0 is clear.

The advisory names the reporters: Ritesh Kumar Kalle, Subhojeet Mukherjee and Hishamudeen of the Cybersecurity Research group, Hitachi India R&D Center. No threat actor, campaign or exploitation in the wild is referenced anywhere in the source.

## 4\. Mitigation & containment

The advisory provides no patched version and no vendor fix. Hitachi Energy directs customers to its service organisation for remediation information. The steps below are the compensating controls the advisory itself recommends, ordered by what reduces exposure fastest.

P1 (within 24 hours)

- Inventory every CoreTec5 and CoreTec4 device on the estate and record its firmware version against `<=3.4.0` and `5.0.0` for CoreTec5, `<=3.4.0` for CoreTec4\. Devices at or below those versions are in scope for CVE-2026-13162; CoreTec5 devices are also in scope for CVE-2026-43284.
- Remove direct internet reachability from every CoreTec device. The advisory's first recommended practice is that control system devices are not accessible from the internet. Check for NAT rules, port forwards and vendor remote-support tunnels that breach this.
- Open a support case with Hitachi Energy (contact list at https://www.hitachienergy.com/contact-us/) requesting the fixed firmware version and a remediation timeline in writing. Record the response for the DORA Art. 28 supplier file.

P2 (within 72 hours)

- Place CoreTec networks behind a firewall with a minimal exposed port set, isolated from business networks, per the advisory's recommended practices. Where remote access is genuinely required, route it through a VPN kept at the current version, and treat the VPN endpoint as part of the attack surface.
- Prohibit browsing, instant messaging and email on CoreTec hosts. The advisory states process control systems should not be used for these.
- Scan removable media and portable computers before they connect to the control system, and enforce the password policy the advisory calls for.

P3 (within 7 days)

- Review firewall and IDS logs for command-injection patterns and unexpected writes reaching CoreTec management interfaces. The advisory gives no signatures, so baseline normal management traffic first and alert on deviation.
- Confirm whether any CoreTec device supports the energy delivery for a site the firm depends on, and fold the answer into the DORA Art. 29 concentration assessment.
- Where no vendor fix is available by the end of the window, document the compensating controls above as the accepted risk position and set a review date.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The advisory contains no hashes, network indicators, file paths, registry keys or command strings, and no exploitation has been reported.

## 6\. Detection

Insufficient indicators to author detection rules. The source provides no artefact of the threat itself: no command strings, no file names, no process behaviour and no network signatures. A rule built on the CVE identifiers or the product name would detect the advisory, not an attack. Detection effort should go to baselining management traffic to CoreTec devices and alerting on deviation, as set out in §4.

## 7\. Sources

- CISA, "Hitachi Energy CoreTec Product" (ICSA-26-302-03), https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03, published 2026-10-29.
- Hitachi Energy PSIRT, advisory 8DBD000258, republished verbatim by CISA in the item above; revision 1 public 2026-10-27, revision 2 CISA republication 2026-10-29.

## 8\. Adverse Trace position

Adverse Trace assesses this as a high-severity (CVSS v3 8.8 per Hitachi Energy) but currently unexploited disclosure: CISA's SSVC records exploitation none and technical impact none as of 2026-10-26, no CISA KEV entry exists, and no EPSS score or CVSS vector is available to refine the rating. The impact on EMEA financial services is second-order, through dependence on CoreTec-equipped energy infrastructure and through the supplier relationship, not through direct targeting of bank systems. The absence of a patched version is the material problem: clients cannot remediate, only contain, and the vendor's own guidance is network isolation. The "Dirty Frag" mechanism and the write-what-where classification are single-sourced to the vendor advisory; verify before relying on them in an incident assessment. We will monitor for a Hitachi Energy firmware release, for any researcher publication on CVE-2026-43284, and for any change in the CISA KEV or SSVC status, and will reissue this advisory if a fix or exploitation report appears. Clients running CoreTec in or adjacent to their estate should treat the P1 inventory and internet-exposure check as due now.

---

[Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*