Hitachi Energy TropOS CVE-2025-1037

Requires an authenticated account on the Hitachi Energy TropOS 4th Gen device that can execute user-level shell commands; the attacker then makes minor configuration changes and abuses a specific set of root-capable scripts/executables to enable an SSH-accessible unrestricted root shell. Limiting factors: exploitation is gated by valid authentication (PR:L), adjacent-network reachability to the device (AV:A), and the presence of the particular vulnerable scripts (AT:P / specific attack requirement) - it is NOT reachable by a remote unauthenticated attacker and cannot be triggered against a default configuration without a logged-in shell user.

This is a privilege-escalation flaw (CWE-269) in the Hitachi Energy TropOS 4th Gen device requiring an already-authenticated user who can run user-level shell commands, then abuse specific root-capable scripts/executables to reach an unrestricted root shell. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:L/UI:N) and the description agree: this is NOT remote-unauthenticated - it needs adjacent-network access AND valid credentials with shell privileges (PR:L), and depends on the presence of the specific vulnerable scripts (AT:P). The 7.5 (High) score is driven entirely by full VC:H/VI:H/VA:H impact once root is obtained, not by ease of initial access. Real-world priority signals are LOW-to-MODERATE: EPSS is 0.15% (4th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or at-scale exploitation. The practical conclusion is a high-impact but gated local/adjacent privilege escalation: the CVSS vector and the description are consistent (both imply the attacker must already be an authenticated shell user), so the realistic risk is post-compromise or malicious-insider escalation on a niche industrial product rather than an internet-facing mass-exploitation threat. No conflicting signals were found, but note that exploit/POC status is simply absent from the provided data rather than confirmed negative.

An authenticated user (or an attacker who has already obtained user-level credentials) on a TropOS 4th Gen device makes minor configuration changes and invokes the specific root-capable scripts/executables to open an SSH-reachable, unrestricted root shell. With root, they fully compromise the device's confidentiality, integrity, and availability - altering mesh networking configuration or pivoting within the utility/industrial network. No public exploit code was identified at the time of analysis.