CVE-2025-48396 HIGH

CVE-2025-48396

Vendor Eaton

Product Eaton Brightlayer Software Suite (BLSS)

Weakness CWE-434 · Unrestricted file upload

Published November 3, 2025

Last update November 4, 2025

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

What the vulnerability does

01Description

Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).

Key dates

02Disclosure timeline

November 3, 2025 CVE published

November 4, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-48396 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-8525 Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload CVE-2024-52302 common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE) CVE-2025-12974 Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload CVE-2024-49327 WordPress Woostagram Connect plugin <= 1.0.2 - Arbitrary File Upload vulnerability CVE-2025-3616 Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload