CVE-2023-2625A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4,…
- 9.0CriticalCVSS base score
- 0.48%Exploitation in 30 daysEPSS · top 58% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user interface that will be executed by the system.
Timeline
ID reserved
By Hitachi Energy
- 49 days later
· 49 days later
Published
- 18 months later
· 18 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| Hitachi EnergyCNA (assigner) | 3.1 | Critical9.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.48% · top 58% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.0.
Affected products
Hitachi Energy · TXpert Hub CoreTec 4
- affected TXpert Hub CoreTec 4 version 2.0.*
- affected TXpert Hub CoreTec 4 version 2.1.*
- affected TXpert Hub CoreTec 4 version 2.2.*
- affected TXpert Hub CoreTec 4 version 2.3.*
- affected TXpert Hub CoreTec 4 version 2.4.*
- unaffected TXpert Hub CoreTec 4 version 3.0.1
What to do
Solution: The vulnerability is remediated in TXpert Hub CoreTec 4 version 3.0.1.
Workaround: Apply mitigation as described in the cybersecurity advisory Mitigation Factors/Workarounds Section.
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2023-34096 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2023-2625)Record last updated .