Read the docs
TI-2025-04041 Aliases CVE-2025-4526GHSA-hf2c-qrvg-6988

Dígitro NGC Explorer Configuration missing password field masking

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such manipulation leads to missing password field masking. It is possible to launch the attack remotely. Upgrading to version 3.48.22 is sufficient to fix this issue. It is suggested to upgrade the affected component. The action taken by the vendor is: "Review and correction of controls related to the exposure of user information in the product configuration interface." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix Fixed NGC Explorer (Dígitro): 3.48.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DígitroNGC Explorer3.48.0; 3.48.1; 3.48.2; 3.48.3; 3.48.4; 3.48.5; 3.48.6; 3.48.7; 3.48.8; 3.48.9; 3.48.10; 3.48.11; 3.48.12; 3.48.13; 3.48.14; 3.48.15; 3.48.16; 3.48.17; 3.48.18; 3.48.19; 3.48.20; 3.48.213.48.22Patch availableCNA
  • NGC Explorer VendorDígitro Affected 3.48.0; 3.48.1; 3.48.2; 3.48.3; 3.48.4; 3.48.5; 3.48.6; 3.48.7; 3.48.8; 3.48.9; 3.48.10; 3.48.11; 3.48.12; 3.48.13; 3.48.14; 3.48.15; 3.48.16; 3.48.17; 3.48.18; 3.48.19; 3.48.20; 3.48.21 Fixed in 3.48.22 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:digitro:ngc_explorer:3.44.15:*:*:*:*:*:*:*3.44.15VulnerableDígitro
  • cpe:2.3:a:digitro:ngc_explorer:3.44.15:*:*:*:*:*:*:* Versions 3.44.15 Vulnerable ·Dígitro

Remediation

  • Fix · CNA NGC Explorer (Dígitro) Fixed in 3.48.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4526
  2. 2026-10-03 Alias added: GHSA-hf2c-qrvg-6988

References

Patch 1

Other 2

  • TI-2025-04042 Dígitro NGC Explorer Password Transmission client-side enforcement of server-side security CVSS 4.0MEDIUM 6.3
  • TI-2025-04043 Dígitro NGC Explorer session expiration CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences