CVE-2025-4528

A weakness has been identified in Dígitro NGC Explorer up to 3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration. The attack can be launched remotely. Upgrading to version 3.48.22 mitigates this issue. It is recommended to upgrade the affected component. The action taken by the vendor is: "Strengthening of session control, expiration and invalidation mechanisms." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://digitro.com/esclarecimentos-recomendacoes-ctir-gov/
https://digitro.com/recomendacao-10-2026-ctir-gov/
https://vuldb.com/cve/CVE-2025-4528
https://vuldb.com/submit/565309
https://vuldb.com/vuln/308273
https://vuldb.com/vuln/308273/cti
https://www.gov.br/ctir/pt-br/assuntos/alertas-e-recomendacoes/recomendacoes/2026/recomendacao-10-2026

Configurations

Configuration 1 (hide)

cpe:2.3:a:digitro:ngc_explorer:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-05-11 03:15

Updated : 2026-07-31 16:16

NVD link : CVE-2025-4528

Mitre link : CVE-2025-4528

CVE.ORG link : CVE-2025-4528

JSON object : View

Products Affected

digitro

ngc_explorer

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-4528", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4528", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-12T14:33:25.278396Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:d_gitro:ngc_explorer:*:*:*:*:*:*:*:*"], "vendor": "D\u00edgitro", "product": "NGC Explorer", "versions": [{"status": "affected", "version": "3.48.0"}, {"status": "affected", "version": "3.48.1"}, {"status": "affected", "version": "3.48.2"}, {"status": "affected", "version": "3.48.3"}, {"status": "affected", "version": "3.48.4"}, {"status": "affected", "version": "3.48.5"}, {"status": "affected", "version": "3.48.6"}, {"status": "affected", "version": "3.48.7"}, {"status": "affected", "version": "3.48.8"}, {"status": "affected", "version": "3.48.9"}, {"status": "affected", "version": "3.48.10"}, {"status": "affected", "version": "3.48.11"}, {"status": "affected", "version": "3.48.12"}, {"status": "affected", "version": "3.48.13"}, {"status": "affected", "version": "3.48.14"}, {"status": "affected", "version": "3.48.15"}, {"status": "affected", "version": "3.48.16"}, {"status": "affected", "version": "3.48.17"}, {"status": "affected", "version": "3.48.18"}, {"status": "affected", "version": "3.48.19"}, {"status": "affected", "version": "3.48.20"}, {"status": "affected", "version": "3.48.21"}, {"status": "unaffected", "version": "3.48.22"}]}]}], "published": "2025-05-11T03:15:24.970", "references": [{"url": "https://digitro.com/esclarecimentos-recomendacoes-ctir-gov/", "source": "cna@vuldb.com"}, {"url": "https://digitro.com/recomendacao-10-2026-ctir-gov/", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2025-4528", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/565309", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/308273", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/308273/cti", "source": "cna@vuldb.com"}, {"url": "https://www.gov.br/ctir/pt-br/assuntos/alertas-e-recomendacoes/recomendacoes/2026/recomendacao-10-2026", "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in D\u00edgitro NGC Explorer up to 3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration. The attack can be launched remotely. Upgrading to version 3.48.22 mitigates this issue. It is recommended to upgrade the affected component. The action taken by the vendor is: \"Strengthening of session control, expiration and invalidation mechanisms.\" The vulnerabilities are limited to NGC Explorer and do not affect other D\u00edgitro products, including UNA and Guardi\u00e3o."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en D\u00edgitro NGC Explorer hasta la versi\u00f3n 3.44.15, clasificada como problem\u00e1tica. Este problema afecta a algunos procesos desconocidos. La manipulaci\u00f3n provoca la expiraci\u00f3n de la sesi\u00f3n. El ataque podr\u00eda iniciarse remotamente. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta divulgaci\u00f3n, pero no respondi\u00f3."}], "lastModified": "2026-07-31T16:16:56.330", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:digitro:ngc_explorer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2C70D15-FD05-44A3-AA64-A97D9A09F44F", "versionEndIncluding": "3.44.15"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}