Hitachi Energy TropOS 4th Gen

• CVE-2025-1038 High 7.5 The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the co 0.3%
• CVE-2025-1037 High 7.5 By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted 0.2%
• CVE-2025-1036 High 8.7 Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute 1.0%