CVE-2025-48393

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton G4 PDU which is available on the Eaton download center.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Aug 6, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-483944.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited CVE-2025-483954.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited CVE-2025-483968.3Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been CVE-2025-483977.1The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed i CVE-2025-48407.5The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a CVE-2025-48419.8A vulnerability was found in D-Link DCS-932L 2.18.01 and classified as critical. Affected by this issue is the function sub_404780 of the fi CVE-2025-484137.7The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shippe CVE-2025-484146.5There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to ad CVE-2025-484156.2A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contai CVE-2025-484168.1An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. H CVE-2025-484176.5The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-code CVE-2025-484187.2A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 t