BaseFortify

Publication date: 2025-10-28

Last updated on: 2025-10-30

Assigner: Hitachi Energy

Description

By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a particular set of scripts and executables that allow for certain commands to be run as root from an unprivileged context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-28

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-28

EPSS Evaluated

2026-07-05

NVD

CVE-2025-1037

EUVD

EUVD-2025-36505

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user who can run user-level shell commands on the TropOS 4th Gen device to make minor configuration changes that enable access to an unrestricted root shell via SSH. This is possible because certain scripts and executables can be abused to run commands as root from an unprivileged context.

Impact Analysis

The vulnerability can lead to privilege escalation, allowing an authenticated user with limited access to gain full root access to the device. This can result in unauthorized control over the device, potentially leading to data compromise, system manipulation, or disruption of services.

Hi! I’m here to help you understand CVE-2025-1037. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70