High severity · published Oct 29, 2024
CVE-2024-41153
Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands
7.2
CVSS
1.6%
EPSS
No
On KEV
Description
Command injection vulnerability in the Edge Computing UI for the
TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the
web UI can execute commands on the device with root privileges,
far more extensive than what the write privilege intends.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
TRO600 · Hitachi Energy
9.1.0.0 through 9.2.0.0 · source: vendor, CISA
TF
Tro610 Firmware · Hitachienergy
9.1.0.0 before 9.2.0.5 · source: NVD
TF
Tro620 Firmware · Hitachienergy
9.1.0.0 before 9.2.0.5 · source: NVD
TF
Tro670 Firmware · Hitachienergy
9.1.0.0 before 9.2.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41153
Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch
More from TRO600
2.7
CVE-2024-41156
Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats