---
id: CVE-2025-1038
title: >-
  The “Diagnostics Tools” page of the web-based configuration utility does not
  properly validate user-controlled input, allowing an authenticated user with
  high privileges to inject commands into the command shell of the TropOS 4th
  Gen dev…
summary: >-
  The “Diagnostics Tools” page of the web-based configuration utility does not
  properly validate user-controlled input, allowing an authenticated user with
  high privileges to inject commands into the command shell of the TropOS 4th
  Gen dev…
severity: none
cwe:
  - CWE-78
published: '2025-10-28'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T11:10:00.250'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-1038'
references:
  - url: >-
      https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
    label: cybersecurity@hitachienergy.com
tags:
  - nvd
epss: 0.00319
epssPercentile: 0.22862
ingestedAt: '2026-10-08T11:31:27.662Z'
---

## Overview

The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute several set-uid (SUID) applications to ultimately gain root access to the TropOS device.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.