Hitachi Energy TropOS
Successful exploitation of these vulnerabilities could allow command injections and privilege escalation.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-1038US | — | — | ||
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject… | ||||
| CVE-2025-1037US | — | — | ||
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH)… | ||||
| CVE-2025-1036US | — | — | ||
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-303-02 JSONself
- ICSA Advisory ICSA-25-303-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (3)
- MitigationTropOS 4th Gen Firmware
Hitachi Energy recommends security practices and firewall configurations to help protect a process control network from attacks that originate from outside the network. Such practices include ensuring that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for browsing the Internet, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationTropOS 4th Gen Firmware
Hitachi Energy recommends security practices and firewall configurations to help protect a process control network from attacks that originate from outside the network. Such practices include ensuring that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for browsing the Internet, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationTropOS 4th Gen Firmware
Hitachi Energy recommends security practices and firewall configurations to help protect a process control network from attacks that originate from outside the network. Such practices include ensuring that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for browsing the Internet, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan