CVE-2025-22495CWE-78

An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card

High · published February 24, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4.

Note - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00440 · 37.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-02-24T16:27Z
EPSS history
Timeline
  • 24 FEB 16:27Z
    An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card
    cvelistv5