Vulnerability · Published Oct 29, 2024 · Assigned by Hitachi Energy
CVE-2024-41153
High 7.2
In plain English
A high-severity OS command injection in TRO600 from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.6%top 24.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges, far more extensive than what the write privilege intends.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | TRO600 | 9.1.0.0 – through 9.2.0.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H