Hitachi Energy warns of critical command injection flaw in CoreTec products

Hitachi Energy has issued a security advisory regarding operating system command injection and Dirty Frag vulnerabilities affecting its CoreTec product line. CISA Alerts reported on October 29, 2026, that the OS command injection vulnerability allows authenticated users with specific roles to execute arbitrary system commands and gain full control over the affected device. [1]

The vulnerabilities pose a direct threat to industrial operations. According to CISA Alerts, successful exploitation of these security flaws can compromise the confidentiality, integrity, and availability of the impacted CoreTec systems. Hitachi Energy has published recommended immediate actions for organizations to mitigate or remediate the risks. [1]

This disclosure follows previous security issues affecting the company's industrial product lines. As FTMQ Security reported earlier, Hitachi Energy previously addressed an unauthenticated servlet access vulnerability in its Asset Suite software and a NULL pointer dereference flaw in its RTU500 series remote terminal units that caused denial of service conditions. [3][4]

Hitachi Energy urges administrators managing affected CoreTec installations to review the official mitigation and remediation steps immediately to protect system availability and prevent unauthorized command execution. [1]