CVE-2025-4527

A security flaw has been discovered in Dígitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission Handler. Performing a manipulation results in client-side enforcement of server-side security. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. Upgrading to version 3.48.22 is sufficient to resolve this issue. Upgrading the affected component is recommended. The action taken by the vendor is: "Strengthening of security validation performed on the server side, together with improvements to administrative and authentication controls." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.

CVSS v3 3.7 LOW
CVSS v2.0 2.6 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://digitro.com/esclarecimentos-recomendacoes-ctir-gov/
https://digitro.com/recomendacao-10-2026-ctir-gov/
https://vuldb.com/cve/CVE-2025-4527
https://vuldb.com/submit/565308
https://vuldb.com/vuln/308272
https://vuldb.com/vuln/308272/cti
https://www.gov.br/ctir/pt-br/assuntos/alertas-e-recomendacoes/recomendacoes/2026/recomendacao-10-2026

Configurations

Configuration 1 (hide)

cpe:2.3:a:digitro:ngc_explorer:3.44.15:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-05-11 03:15

Updated : 2026-07-31 16:16

NVD link : CVE-2025-4527

Mitre link : CVE-2025-4527

CVE.ORG link : CVE-2025-4527

JSON object : View

Products Affected

digitro

ngc_explorer

CWE

CWE-602

Client-Side Enforcement of Server-Side Security

{"id": "CVE-2025-4527", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4527", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-12T14:37:44.613444Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:d_gitro:ngc_explorer:*:*:*:*:*:*:*:*"], "vendor": "D\u00edgitro", "modules": ["Password Transmission Handler"], "product": "NGC Explorer", "versions": [{"status": "affected", "version": "3.48.0"}, {"status": "affected", "version": "3.48.1"}, {"status": "affected", "version": "3.48.2"}, {"status": "affected", "version": "3.48.3"}, {"status": "affected", "version": "3.48.4"}, {"status": "affected", "version": "3.48.5"}, {"status": "affected", "version": "3.48.6"}, {"status": "affected", "version": "3.48.7"}, {"status": "affected", "version": "3.48.8"}, {"status": "affected", "version": "3.48.9"}, {"status": "affected", "version": "3.48.10"}, {"status": "affected", "version": "3.48.11"}, {"status": "affected", "version": "3.48.12"}, {"status": "affected", "version": "3.48.13"}, {"status": "affected", "version": "3.48.14"}, {"status": "affected", "version": "3.48.15"}, {"status": "affected", "version": "3.48.16"}, {"status": "affected", "version": "3.48.17"}, {"status": "affected", "version": "3.48.18"}, {"status": "affected", "version": "3.48.19"}, {"status": "affected", "version": "3.48.20"}, {"status": "affected", "version": "3.48.21"}, {"status": "unaffected", "version": "3.48.22"}]}]}], "published": "2025-05-11T03:15:24.740", "references": [{"url": "https://digitro.com/esclarecimentos-recomendacoes-ctir-gov/", "source": "cna@vuldb.com"}, {"url": "https://digitro.com/recomendacao-10-2026-ctir-gov/", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2025-4527", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/565308", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/308272", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/308272/cti", "source": "cna@vuldb.com"}, {"url": "https://www.gov.br/ctir/pt-br/assuntos/alertas-e-recomendacoes/recomendacoes/2026/recomendacao-10-2026", "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-602"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in D\u00edgitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission Handler. Performing a manipulation results in client-side enforcement of server-side security. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. Upgrading to version 3.48.22 is sufficient to resolve this issue. Upgrading the affected component is recommended. The action taken by the vendor is: \"Strengthening of security validation performed on the server side, together with improvements to administrative and authentication controls.\" The vulnerabilities are limited to NGC Explorer and do not affect other D\u00edgitro products, including UNA and Guardi\u00e3o."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad en D\u00edgitro NGC Explorer 3.44.15, clasificada como problem\u00e1tica. Esta vulnerabilidad afecta al c\u00f3digo desconocido del componente \"Password Transmission Handler\". La manipulaci\u00f3n permite la aplicaci\u00f3n de la seguridad del servidor por parte del cliente. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece dif\u00edcil de explotar. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta revelaci\u00f3n, pero no respondi\u00f3."}], "lastModified": "2026-07-31T16:16:56.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:digitro:ngc_explorer:3.44.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E62990A8-47F0-4E03-9119-1980C3AB230E"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}