« Volver al listado

CVE-2025-27631

Estado: AplazadaMedia (6.5)—

The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Trmtracker — TrmtrackerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27631",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27631",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-25T13:07:38.216323Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@hitachienergy.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@hitachienergy.com",
      "affectedData": [
        {
          "vendor": "Hitachi Energy",
          "product": "TRMTracker",
          "versions": [
            {
              "status": "affected",
              "version": "6.2",
              "versionType": "custom",
              "lessThanOrEqual": "6.2.04"
            },
            {
              "status": "affected",
              "version": "6.3",
              "versionType": "custom",
              "lessThanOrEqual": "6.3.01"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-25T13:15:40.947",
  "references": [
    {
      "url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch",
      "source": "cybersecurity@hitachienergy.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@hitachienergy.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-90"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website."
    },
    {
      "lang": "es",
      "value": "La aplicación web TRMTracker es vulnerable a ataques de inyección LDAP que potencialmente permiten a un atacante inyectar código en una consulta y ejecutar comandos remotos que pueden leer y actualizar datos en el sitio web."
    }
  ],
  "lastModified": "2026-06-17T09:03:55.953",
  "sourceIdentifier": "cybersecurity@hitachienergy.com"
}