{"id":"CVE-2024-41153","state":"PUBLISHED","title":"Command injection vulnerability in the Edge Computing UI for the","description":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends.","publishedAt":"2024-10-29T12:30:31.402Z","updatedAt":"2025-11-04T16:00:52.178Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"Hitachi Energy"},"assigner":"Hitachi Energy","products":["Hitachi Energy TRO600"],"affected":[{"vendor":"Hitachi Energy","product":"TRO600","defaultStatus":"unaffected","versions":[{"version":"9.1.0.0","status":"affected","lessThanOrEqual":"9.2.0.0","versionType":"custom"}]}],"references":["https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/41xxx/CVE-2024-41153.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-41153","state":"PUBLISHED","datePublished":"2024-10-29T12:30:31.402Z","dateUpdated":"2025-11-04T16:00:52.178Z","assignerShortName":"Hitachi Energy","assignerOrgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateReserved":"2024-07-16T16:02:30.295Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends."}],"affected":[{"vendor":"Hitachi Energy","product":"TRO600","defaultStatus":"unaffected","versions":[{"version":"9.1.0.0","status":"affected","lessThanOrEqual":"9.2.0.0","versionType":"custom"}]}],"references":[{"url":"https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Hitachi Energy","orgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateUpdated":"2025-10-24T08:38:07.234Z"},"impacts":[{"capecId":"CAPEC-248","descriptions":[{"lang":"en","value":"CAPEC-248 Command Injection"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"hitachi_energy","product":"tro600","defaultStatus":"unknown","versions":[{"version":"9.1.0.0","status":"affected","lessThanOrEqual":"9.2.0.0","versionType":"custom"}],"cpes":["cpe:2.3:a:hitachi_energy:tro600:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-29T13:54:05.290769Z","id":"CVE-2024-41153","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-11-04T16:00:52.178Z"}}]}}}