CVE-2025-4526
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21, affecting an unknown function of the Configuration Page component, leading to missing password field masking. The attack can be launched remotely. Upgrading to version 3.48.22 fixes this issue by reviewing and correcting controls related to user information exposure.
Risk Assessment
The risk involves potential exposure of passwords in the configuration interface, which could enable unauthorized access to the system.
Recommendation
It is recommended to upgrade immediately to version 3.48.22 or later.
Other vulnerabilities in Dígitro NGC Explorer
See all- CVE-2025-4528Medium
A weakness has been identified in Dígitro NGC Explorer up to 3.48.21, affecting an unknown function that allows remote session expiration. Upgrading to version 3.48.22 fixes this issue by strengthening session control, expiration, and invalidation mechanisms.
- CVE-2025-4527Low
A security flaw in Dígitro NGC Explorer up to 3.48.21 involves an unknown function of the Password Transmission Handler, resulting in client-side enforcement of server-side security. The attack can be initiated remotely but is difficult to exploit. Upgrading to version 3.48.22 resolves the issue.
Original NVD description (English source)
A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such manipulation leads to missing password field masking. It is possible to launch the attack remotely. Upgrading to version 3.48.22 is sufficient to fix this issue. It is suggested to upgrade the affected component. The action taken by the vendor is: "Review and correction of controls related to the exposure of user information in the product configuration interface." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS