Vulnerability · Published Nov 3, 2025 · Assigned by Eaton
CVE-2025-48396
High 8.3
In plain English
A high-severity unrestricted file upload in Eaton Brightlayer Software Suite (BLSS) from Eaton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.4%top 69.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eaton | Eaton Brightlayer Software Suite (BLSS) | 0 – through 7.3.x |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H