CVE-2024-41153

Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges, far more extensive than what the write privilege intends.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:hitachienergy:tro610_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hitachienergy:tro610:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:hitachienergy:tro620_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hitachienergy:tro620:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:hitachienergy:tro670_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hitachienergy:tro670:-:*:*:*:*:*:*:*

History

24 Oct 2025, 09:15

Type	Values Removed	Values Added
CWE		CWE-78

Information

Published : 2024-10-29 13:15

Updated : 2025-10-24 09:15

NVD link : CVE-2024-41153

Mitre link : CVE-2024-41153

CVE.ORG link : CVE-2024-41153

JSON object : View

Products Affected

hitachienergy

tro620
tro620_firmware
tro670
tro610_firmware
tro610
tro670_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2024-41153", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cybersecurity@hitachienergy.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-10-29T13:15:04.600", "references": [{"url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch", "tags": ["Vendor Advisory"], "source": "cybersecurity@hitachienergy.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "cybersecurity@hitachienergy.com", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de comandos en la interfaz de usuario de Edge Computing para las radios de la serie TRO600 que permite la ejecuci\u00f3n de comandos arbitrarios del sistema. Si se explota, un atacante con acceso de escritura a la interfaz de usuario web puede ejecutar comandos en el dispositivo con privilegios de root, mucho m\u00e1s amplios que los que pretende el privilegio de escritura."}], "lastModified": "2025-10-24T09:15:39.647", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hitachienergy:tro610_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5C2D2E0-5383-44E5-B8C6-C743503A8E51", "versionEndExcluding": "9.2.0.5", "versionStartIncluding": "9.1.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hitachienergy:tro610:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B3A46C6E-9314-40EB-A8BE-0D3A26B5FE4C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hitachienergy:tro620_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BE01813-8087-4E9B-8B2B-FF813C0E9506", "versionEndExcluding": "9.2.0.5", "versionStartIncluding": "9.1.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hitachienergy:tro620:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DC979E74-6316-4BED-87A6-4DC9B9747E0F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hitachienergy:tro670_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6A94F87-2875-46C9-8BD3-BE3EA9F71648", "versionEndExcluding": "9.2.0.5", "versionStartIncluding": "9.1.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hitachienergy:tro670:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E84F6910-1D58-4AE7-94EF-797C9BD52690"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@hitachienergy.com"}