CVE-2025-1036

published 2025-10-28

CVE-2025-1036: Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access…

Priority P2 64 high 8.7 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
hitachi_energy	tropos_4th_gen	8.7.0.0 – 8.9.6.0	—

Detection & IOCs extracted from sources · hover to see the quote

• → Monitor for OS command injection attempts targeting the 'Logging' page of the TropOS web-based configuration utility from low-privileged authenticated users ↗
• → Alert on unexpected root SSH sessions originating from the TropOS 4th Gen device, which may indicate successful exploitation of CVE-2025-1036 via the Logging page command injection ↗

• · Vulnerability only affects TropOS 4th Gen Firmware versions 8.9.6.0 and prior; devices updated to 8.9.7.0 are not affected ↗
• · Exploitation requires authenticated access (low-privileged) to the web-based configuration utility; unauthenticated remote exploitation is not possible ↗
• · No known public exploitation of this vulnerability has been reported at time of advisory publication ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78