Log in Start free

Vulnerability · Published May 11, 2025 · Assigned by VulDB

CVE-2025-4526Dígitro NGC Explorer Configuration missing password field masking

Medium 4.3

In plain English

A medium-severity information exposure in NGC Explorer from Dígitro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 77.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such manipulation leads to missing password field masking. It is possible to launch the attack remotely. Upgrading to version 3.48.22 is sufficient to fix this issue. It is suggested to upgrade the affected component. The action taken by the vendor is: "Review and correction of controls related to the exposure of user information in the product configuration interface." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.

Affected products (as reported)

VendorProductVersions
Dígitro NGC Explorer 3.48.03.48.13.48.23.48.33.48.43.48.53.48.63.48.7

Weakness: CWE-549, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

References