CVE-2026-13162

HighCVSS 7.7/10Last modified Nov 4, 2026

Description

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.

Metrics

CVSS 4.0 7.7/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-131635.3Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all CVE-2026-131648.8Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps/accounts/views.py), exposed at POST /api/auth/register/, in CVE-2026-131658.6SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native librar CVE-2026-131674.3The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorizati CVE-2026-131686.5The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-le CVE-2026-131698.1The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or re CVE-2026-13176.5The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and inclu CVE-2026-131707.2The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allo CVE-2026-131718.2The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unaut CVE-2026-131725.3The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API CVE-2026-131732.7The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and upd CVE-2026-131747.2The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contr