Hitachi Energy TropOS 4th Gen Command Injection Vulnerability Allowing Unauthorized SSH Access

A command injection vulnerability has been identified in the Logging page of the web-based configuration utility for Hitachi Energy TropOS 4th Gen devices. This vulnerability allows an authenticated user with low privileged network access to the configuration utility to execute arbitrary commands on the underlying operating system. Exploiting this vulnerability could lead to unauthorized root SSH access on the device.

Impact

Exploitation of this vulnerability could result in unauthorized command execution on the device's operating system, potentially leading to root SSH access.