CVE-2025-4526
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21, affecting an unknown function of the Configuration Page component, leading to missing password field masking. The attack can be launched remotely. Upgrading to version 3.48.22 fixes this issue by reviewing and correcting controls related to user information exposure.
Risk Assessment
The risk involves potential exposure of passwords in the configuration interface, which could enable unauthorized access to the system.
Recommendation
It is recommended to upgrade immediately to version 3.48.22 or later.
Original NVD description (English source)
A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such manipulation leads to missing password field masking. It is possible to launch the attack remotely. Upgrading to version 3.48.22 is sufficient to fix this issue. It is suggested to upgrade the affected component. The action taken by the vendor is: "Review and correction of controls related to the exposure of user information in the product configuration interface." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.