CVE-2025-1036: hitachi energy tropos 4th gen OS Command Injection
CVSS: 8.7v4.0HighDeferred
Published 28-10-2025Last modified 28-10-2025
Vulnerability summary
CVE-2025-1036 is a high (CVSS 8.7) OS Command Injection vulnerability in hitachi energy tropos 4th gen. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.7% of scored vulnerabilities.
CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
1.05%
0%100%
Low · -0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 28-10-2025PublishedVulnerability first disclosed.
- 28-10-2025Last modifiedVulnerability information updated.
Description
Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
1.05%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
-0.03 pp
From 1.07% on 20-09-2026
20-09-202620-10-2026
EPSS score1.05%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Hitachi energy1 product
- tropos 4th gen≥ 8.7.0.0, ≤ 8.9.6.0
1 vendor · 1 product