CVE-2025-1038
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The “Diagnostics Tools” page of the TropOS 4th Gen web configuration utility does not properly validate user-controlled input, allowing an authenticated high-privileged user to inject commands into the device command shell. Injected commands can be used to execute SUID applications and gain root access.
Risk Assessment
A high-privileged attacker can execute arbitrary commands and obtain root access to the TropOS device, resulting in full device compromise.
Recommendation
Restrict access to the “Diagnostics Tools” page to trusted administrators only and apply the vendor patch when available. Consider disabling or limiting diagnostic features in production.
Other vulnerabilities in TropOS 4th Gen
See all- CVE-2025-1037High
On TropOS 4th Gen devices, an authenticated user able to run user-level shell commands can gain access via SSH to an unrestricted root shell. This is possible through abuse of a set of scripts and executables that allow certain commands to be run as root from an unprivileged context.
- CVE-2025-1036High
A command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.
Original NVD description (English source)
The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute several set-uid (SUID) applications to ultimately gain root access to the TropOS device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS