CVE-2025-48393CWE-295

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a…

Medium · published August 6, 2025

CVSS v3.1
5.7
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton G4 PDU which is available on the Eaton download center.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.6th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2025-08-06T15:25Z
EPSS history
Timeline
  • 06 AUG 15:25Z
    The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a…
    cvelistv5