Medium severity · published Mar 25, 2025
CVE-2025-27632
A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors,…
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
TRMTracker · Hitachi Energy
6.2 through 6.2.04; 6.3 through 6.3.01 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27632
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27632
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch
More from TRMTracker
6.5
CVE-2025-27631
The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and…
6.1
CVE-2025-27633
The TRMTracker web application is vulnerable to reflected Cross-site scripting attack