{"id":"CVE-2024-41153","aliases":["EUVD-2024-38951","GHSA-3rpw-c8rg-p3f5"],"status":"published","title":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows...","description":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01606,"percentile":0.76088,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77","CWE-78"],"published":"2024-10-29T12:30:31Z","modified":"2026-06-17T07:47:22Z","products":[{"vendor":"hitachi energy","product":"tro600"},{"vendor":"hitachi_energy","product":"tro600"},{"vendor":"hitachienergy","product":"tro610_firmware"},{"vendor":"hitachienergy","product":"tro620_firmware"},{"vendor":"hitachienergy","product":"tro670_firmware"}],"references":[{"url":"https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=launch","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41153"},{"url":"https://github.com/advisories/GHSA-3rpw-c8rg-p3f5"}],"sources":{"cve":[{"id":"CVE-2024-41153","description":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends.","status":"published","published":"2024-10-29T12:30:31.402Z","modified":"2025-11-04T16:00:52.178Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-38951","description":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends.","status":"published","published":"2024-10-29T12:30:31Z","modified":"2025-11-04T16:00:52Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.391161Z"}],"ghsa":[{"id":"GHSA-3rpw-c8rg-p3f5","title":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows...","description":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends.","status":"published","published":"2024-10-29T15:32:04Z","modified":"2025-10-24T09:31:58Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:04:12.620224Z"}],"nvd":[{"id":"CVE-2024-41153","description":"Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends.","status":"published","published":"2024-10-29T13:15:04.6Z","modified":"2026-06-17T07:47:22.73Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78","CWE-77"],"updated_at":"2026-11-02T14:10:35.289159Z"}]}}