An operating system command injection flaw exists in Hitachi Energy’s CoreTec configuration daemon’s time synchronization handler. When an authenticated user submits a time‑zone update, the daemon concatenates the supplied input into a shell command without sanitization or validation, allowing the user to execute arbitrary system commands with full control over the device. This weakness is a classic OS command injection (CWE‑78) and grants an attacker complete compromise of confidentiality, integrity, and availability.

The vulnerability affects Hitachi Energy CoreTec 4 and CoreTec 5 product lines. No specific product versions are listed, so all current builds of these products are potentially affected.

The CVSS score of 7.7 classifies this flaw as high severity. EPSS information is not available, so the likelihood of exploitation remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local: an authenticated user with a role that permits time‑zone configuration can trigger the command injection and achieve full device control.