CVE-2025-1038CWE-78command-injection

CVE-2025-1038

published October 28, 2025

CVSS
7.5
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute several set-uid (SUID) applications to ultimately gain root access to the TropOS device.

The record
Technical detail
CVSS
7.5 · NONE
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-28T17:15Z
References (1)
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch · [email protected]
EPSS history
Timeline
  • 28 OCT 12:17Z
    The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high…
    cvelistv5