CVE-2025-27631

MEDIUM

TRMTracker - Code Injection

Title source: llm

Description

The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website.

References (1)

[Various Sources] https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch

Scores

CVSS v3 6.5

EPSS 0.0022

EPSS Percentile 44.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-90

Status published

Products (2)

Hitachi Energy/TRMTracker 6.2 - 6.2.04

Hitachi Energy/TRMTracker 6.3 - 6.3.01

Published Mar 25, 2025

Tracked Since Feb 18, 2026