Vulnerability details
CVE-2025-48396
Eaton Brightlayer Software Suite
CVSS 3.1
8.3High
Official description
Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.3High | 3.1 | CVEProject cvelistV5 (CNA) (Eaton) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Eaton | Eaton Brightlayer Software Suite (BLSS) | v ≤ 7.3.x | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-11-03
- Last updated
- 2025-11-04
- State
- Published
- Assigner (CNA)
- Eaton
Exploit prediction (EPSS)
0.36%
Probability of exploitation in 30 days
30%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-434Unrestricted Upload of File with Dangerous Type