Hitachi Energy TropOS 4th Gen Command Injection Vulnerability Allowing Privileged User to Gain Root Access

A command injection vulnerability has been identified in the web-based configuration utility of Hitachi Energy's TropOS 4th Generation devices. The issue arises on the 'Diagnostics Tools' page, where user input is not properly validated. This flaw allows an authenticated user with high privileges to inject commands that are executed in the device's command shell. Exploitation of this vulnerability could be used to run various set-uid applications, ultimately leading to root access on the TropOS device.

Impact

Exploitation of this vulnerability allows for unauthorized command execution with elevated privileges, potentially leading to a full compromise of the affected TropOS device by gaining root access.