High severity · published Oct 28, 2025
CVE-2025-1038
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject…
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute several set-uid (SUID) applications to ultimately gain root access to the TropOS device.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
T4
TropOS 4th Gen · Hitachi Energy
8.7.0.0 before 8.9.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1038
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1038
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
More from TropOS 4th Gen
8.7
CVE-2025-1036
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility
7.5
CVE-2025-1037
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell…