Security Flaws Found in Hitachi Energy Products

Hitachi Energy's CoreTec and TRO600 series products have been found to contain multiple security vulnerabilities that could potentially allow unauthorized access and remote code execution, according to advisories published by the Cybersecurity and Infrastructure Security Agency (CISA) on October 29, 2026.

CoreTec Vulnerabilities

The CoreTec product line, specifically versions CoreTec5/<=3. 4. 0 and 5.

0. 0, and CoreTec4/<=3. 4.

0, are affected by OS command injection and Dirty Frag vulnerabilities. These issues, identified as CVE-2026-13162 and CVE-2026-43284, could impact the confidentiality, integrity, and availability of the products. The OS command injection vulnerability allows authenticated users with specific roles to execute arbitrary system commands, while the Dirty Frag vulnerability in the IPsec ESP subsystem of the Linux kernel could enable a local unprivileged user to escalate privileges to root.

The vulnerabilities were reported to CISA by Ritesh Kumar Kalle, Subhojeet Mukherjee, and Hishamudeen from the Cybersecurity Research group at Hitachi India R&D Center. To mitigate these risks, Hitachi Energy recommends updating to CoreTec5 version 5.0.0.

TRO600 Series Vulnerabilities

The TRO600 series products, including versions 9. 2. 1.

6 and earlier, as well as 9. 1. 1.

0, 9. 2. 2.

1, and 9. 1. 2.

0, are also affected by significant vulnerabilities. CVE-2026-10756 allows an authenticated attacker to bypass network access restrictions, while CVE-2026-106087 is an arbitrary file read vulnerability that can be exploited by an unauthenticated attacker to read or download arbitrary files on the affected device.

Hitachi Energy's internal team reported these vulnerabilities to CISA. The recommended fix is to update to version 9. 2.

2. 1 to address these issues.

Mitigation and Recommendations

CISA advises that proper security practices and firewall configurations can help protect process control networks from attacks. This includes ensuring that process control systems are physically protected from direct access by unauthorized personnel, have no direct Internet connections, and are separated from other networks by a firewall system with minimal exposed ports.

Hitachi Energy, headquartered in Switzerland, emphasizes that the information provided in the advisories is subject to change and should not be construed as a commitment. The company assumes no responsibility for any errors in the document and advises users to contact their product provider or Hitachi Energy service organization for additional support and information.