CVE-2025-3364: HGiga PowerStation - Chroot Escape

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-08 · updated 2026-06-17
Weakness: CWE-250

Description

The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access the entire file system.

Affected products

HGiga PowerStation: before x64.6.2.213 — fixed in x64.6.2.213

How to fix

Upgrade to a fixed version: HGiga PowerStation x64.6.2.213. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/en/cp-139-10058-fce0b-2.html
https://www.twcert.org.tw/tw/cp-132-10057-58c05-1.html

Get alerted when CVE-2025-3364 or the next vulnerability affects your stack