CVE-2025-4528 is a medium severity session expiration weakness (CVSS 4.3) in Dígitro NGC Explorer up to version 3.48.21. Upgrading to 3.48.22 mitigates it. Plan the upgrade and review who has access to the product.
What's affected
Per the CVE record, Dígitro NGC Explorer up to 3.48.21 is affected. The record says that upgrading to version 3.48.22 mitigates the issue, and it quotes the vendor action as "Strengthening of session control, expiration and invalidation mechanisms."
The record also says the vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião. The affected function is not named. The record describes it as an unknown function where a manipulation can lead to session expiration problems, and says the attack can be launched remotely.
The CVSS vector needs a low privilege account, no user interaction and gives low integrity impact only, which explains the medium score of 4.3. The record reports no attacks in the wild, and the KEV flag is false.
I could not retrieve the vendor's pages when I wrote this, so read the Dígitro notice listed in the sources for the full statement.
How to check if you're exposed
Find the NGC Explorer version in the product's about or system page, or ask whoever administers it. Anything at or below 3.48.21 is in scope, and 3.48.22 is the version the record names as the mitigation.
Then check who can reach it. A tool like this is often used by a small team, so the access list should be short. Check firewall rules and reverse proxy settings, and see whether the login page answers from outside your network.
If you can, test session behavior in a safe environment. Sign in, sign out, and then check whether the old session is still accepted. Sessions that stay valid after logout or after a timeout are the sign of this kind of weakness. Do this on a test copy and with your own account only.
What to do now
- Confirm the NGC Explorer version in every environment.
- Schedule the upgrade to 3.48.22 or later, following Dígitro's own instructions.
- Limit network access to the product to the people who need it.
- Review idle timeout and logout settings, and shorten them if the product allows.
- Review the account list and remove stale users.
- After upgrading, confirm that signing out ends the session.
Why it matters
The record maps the issue to CWE-613, insufficient session expiration. When sessions do not end as they should, a stolen or shared session token stays useful for longer than it ought to. That gives an attacker more time to reuse a login they should not have.
It is a quieter weakness than injection bugs, and a medium rating is fair. Still, session handling is the basis of every logged in feature in a web product, and fixes here reduce the damage from other problems such as stolen cookies or shared workstations.
Use it as a prompt to check timeouts in other tools you run. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can help with the libraries in your own apps, and the Gold directory lists related CVEs by product.
Quick check
Is CVE-2025-4528 being exploited in the wild?
The record does not report exploitation and its CISA KEV flag is false. That can change, so check the CISA catalog again before you decide how urgent this is.
Which version fixes CVE-2025-4528?
The record says upgrading to 3.48.22 mitigates the issue. Confirm the details in Dígitro's notice before you roll it out.
Sources
- CVE-2025-4528 on Gold
- NVD record for CVE-2025-4528
- Reference listed in the CVE record: Dígitro notices on CTIR Gov recommendations. They returned an access error when I tried to fetch them, so check them directly.
Last reviewed: 18 October 2026.
