Skip to content
Sign in
8.7 High

CVE-2025-1036 Command injection vulnerability exists in the “Logging” page of the web-based configuration utility

Description

Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.

Affected products and versions

Product Affected versions Fixed in
TropOS 4th Gen 8.7 8.7.0.0 → 8.9.6.0 No fix stated

Other CVEs of TropOS 4th Gen

The 3 CVEs of TropOS 4th Gen →
CVE-2025-1038 The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input,… 7.5 High CVE-2025-1037 By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user… 7.5 High
Track this CVE