CVE-2024-41156
CVE-2024-41156 is a low-severity vulnerability in Hitachienergy Tro610 Firmware with a CVSS 3.x base score of 2.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-212.
Key facts
- Severity: Low (CVSS 3.x base score 2.7)
- EPSS exploit prediction: 0% (28th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-39328
- Weakness: CWE-212
- Affected product: Hitachienergy Tro610 Firmware
- Published:
- Last modified:
Description
Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated users with higher privilege of write access.
Frequently asked questions
- What is CVE-2024-41156?
- Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated users with higher privilege of write access.
- How severe is CVE-2024-41156?
- CVE-2024-41156 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2024-41156 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-41156?
- CVE-2024-41156 primarily affects Hitachienergy Tro610 Firmware. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2024-41156?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-41156 have an EU (EUVD) identifier?
- Yes. CVE-2024-41156 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-39328.
- When was CVE-2024-41156 published?
- CVE-2024-41156 was published on 2024-10-29 and last updated on 2026-06-17.
References
Affected products (3)
- cpe:2.3:o:hitachienergy:tro610_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:hitachienergy:tro620_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:hitachienergy:tro670_firmware:*:*:*:*:*:*:*:*
More vulnerabilities in Hitachienergy Tro610 Firmware
- CVE-2024-41153 — High (CVSS 7.2): Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of…
All CVEs affecting Hitachienergy Tro610 Firmware →
Other CWE-212 vulnerabilities
- CVE-2022-2818 — Critical (CVSS 9.8): Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to…
- CVE-2020-11684 — Critical (CVSS 9.1): AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control…
- CVE-2026-39937 — High (CVSS 8.8): Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation…
- CVE-2022-30617 — High (CVSS 8.8): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and…
- CVE-2022-0355 — High (CVSS 8.8): Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.
- CVE-2021-0340 — High (CVSS 8.8): In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input…