CVE-2025-22495
High
Description
An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. Note - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.
SeverityHigh
CVSS8.4
Exploit probability—
ProductNetwork M2
PublishedFeb 24, 2025
First seenFeb 24, 2025
Weakness typeCWE-78OS command injection
How to fix
Update
- Eaton Network M23.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Eaton Network M2 | v < 3.0.4 | 3.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.