Read the docs
TI-2025-04043 Aliases CVE-2025-4528GHSA-9v5v-3jhc-pffj

Dígitro NGC Explorer session expiration

Priority LOW 24CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

A weakness has been identified in Dígitro NGC Explorer up to 3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration. The attack can be launched remotely. Upgrading to version 3.48.22 mitigates this issue. It is recommended to upgrade the affected component. The action taken by the vendor is: "Strengthening of session control, expiration and invalidation mechanisms." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0041 35th percentileScored 2026-11-07
Fix Fixed NGC Explorer (Dígitro): 3.48.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DígitroNGC Explorer3.48.0; 3.48.1; 3.48.2; 3.48.3; 3.48.4; 3.48.5; 3.48.6; 3.48.7; 3.48.8; 3.48.9; 3.48.10; 3.48.11; 3.48.12; 3.48.13; 3.48.14; 3.48.15; 3.48.16; 3.48.17; 3.48.18; 3.48.19; 3.48.20; 3.48.213.48.22Patch availableCNA
  • NGC Explorer VendorDígitro Affected 3.48.0; 3.48.1; 3.48.2; 3.48.3; 3.48.4; 3.48.5; 3.48.6; 3.48.7; 3.48.8; 3.48.9; 3.48.10; 3.48.11; 3.48.12; 3.48.13; 3.48.14; 3.48.15; 3.48.16; 3.48.17; 3.48.18; 3.48.19; 3.48.20; 3.48.21 Fixed in 3.48.22 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:digitro:ngc_explorer:*:*:*:*:*:*:*:*up to 3.44.15VulnerableDígitro
  • cpe:2.3:a:digitro:ngc_explorer:*:*:*:*:*:*:*:* Versions up to 3.44.15 Vulnerable ·Dígitro

Remediation

  • Fix · CNA NGC Explorer (Dígitro) Fixed in 3.48.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4528
  2. 2026-10-03 Alias added: GHSA-9v5v-3jhc-pffj

References

Patch 1

Other 2

  • TI-2025-04042 Dígitro NGC Explorer Password Transmission client-side enforcement of server-side security CVSS 4.0MEDIUM 6.3
  • TI-2025-04041 Dígitro NGC Explorer Configuration missing password field masking CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences