{"id":"CVE-2025-22495","aliases":["EUVD-2025-4287","GHSA-pjqh-q2j4-8c7q"],"status":"published","title":"An improper input validation vulnerability was discovered in the NTP server configuration field...","description":"An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. \nNote - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0044,"percentile":0.38543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-78"],"published":"2025-02-24T16:27:46Z","modified":"2026-06-17T08:47:45Z","products":[{"vendor":"eaton","product":"network m2"}],"references":[{"url":"https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1004.pdf"},{"url":"https://www.eaton.com/content/dam/eaton/products/backup-power-ups-surge-it-power-distribution/power-management-software-connectivity/eaton-gigabit-network-card/Network-M2%20EOL.pdf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22495"},{"url":"https://github.com/advisories/GHSA-pjqh-q2j4-8c7q"}],"sources":{"cve":[{"id":"CVE-2025-22495","description":"An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. \nNote - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.","status":"published","published":"2025-02-24T16:27:46.924Z","modified":"2025-08-26T10:31:04.935Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-4287","description":"An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. \nNote - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.","status":"published","published":"2025-02-24T16:27:46Z","modified":"2025-08-26T10:31:04Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:53.596813Z"}],"ghsa":[{"id":"GHSA-pjqh-q2j4-8c7q","title":"An improper input validation vulnerability was discovered in the NTP server configuration field...","description":"An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. \nNote - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.","status":"published","published":"2025-02-24T18:32:42Z","modified":"2025-08-26T12:30:23Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-78"],"updated_at":"2026-11-02T15:03:24.313553Z"}],"nvd":[{"id":"CVE-2025-22495","description":"An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. \nNote - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.","status":"published","published":"2025-02-24T17:15:13.723Z","modified":"2026-06-17T08:47:45.473Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:51.871789Z"}]}}