CVE-2025-1037
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
On TropOS 4th Gen devices, an authenticated user able to run user-level shell commands can gain access via SSH to an unrestricted root shell. This is possible through abuse of a set of scripts and executables that allow certain commands to be run as root from an unprivileged context.
Risk Assessment
A user with a regular account on the device can escalate privileges to root and take full control of the device. This poses a serious risk to the confidentiality, integrity, and availability of the network device.
Recommendation
Restrict access to user accounts on TropOS 4th Gen devices and apply the vendor patches that eliminate the script-based privilege escalation path.
Other vulnerabilities in TropOS 4th Gen
See all- CVE-2025-1038High
The “Diagnostics Tools” page of the TropOS 4th Gen web configuration utility does not properly validate user-controlled input, allowing an authenticated high-privileged user to inject commands into the device command shell. Injected commands can be used to execute SUID applications and gain root access.
- CVE-2025-1036High
A command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.
Original NVD description (English source)
By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a particular set of scripts and executables that allow for certain commands to be run as root from an unprivileged context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS