CVE-2025-1036CWE-78command-injection

CVE-2025-1036

published October 28, 2025

CVSS
8.7
EPSS
1%
Percentile
63.9
In the wild
Unconfirmed
What it is

Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.01048 · 63.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-28T17:15Z
References (1)
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch · [email protected]
EPSS history
Timeline
  • 28 OCT 12:15Z
    Command injection vulnerability exists in the “Logging” page of the web-based configuration utility
    cvelistv5