CVE-2025-48395

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on the Eaton download center.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Sep 5, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-483968.3Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has beenCVE-2025-483977.1The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed iCVE-2025-48407.5The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a CVE-2025-48419.8A vulnerability was found in D-Link DCS-932L 2.18.01 and classified as critical. Affected by this issue is the function sub_404780 of the fiCVE-2025-484137.7The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shippeCVE-2025-484146.5There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to adCVE-2025-484156.2A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contaiCVE-2025-484168.1An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. HCVE-2025-484176.5The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-codeCVE-2025-484187.2A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 tCVE-2025-48429.8A vulnerability was found in D-Link DCS-932L 2.18.01. It has been declared as critical. This vulnerability affects the function isUCPCameraNCVE-2025-484286.7Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to th
CVE-2025-48395: Medium severity, CVSS 4.7 | Vulnix