High severity · published Oct 28, 2025
CVE-2025-1037
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell…
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a particular set of scripts and executables that allow for certain commands to be run as root from an unprivileged context.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
T4
TropOS 4th Gen · Hitachi Energy
8.7.0.0 through 8.9.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1037
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
More from TropOS 4th Gen
8.7
CVE-2025-1036
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility
7.5
CVE-2025-1038
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject…
