High severity · published Oct 28, 2025
CVE-2025-1036
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility
8.7
CVSS
1%
EPSS
No
On KEV
Description
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
T4
TropOS 4th Gen · Hitachi Energy
8.7.0.0 through 8.9.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1036
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
More from TropOS 4th Gen
7.5
CVE-2025-1038
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject…
7.5
CVE-2025-1037
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell…