Digito NGC Explorer CVE-2025-4527/4528 Vulnerability Advisory

Vulnerability Overview Vulnerability IDs: CVE-2025-4527 and CVE-2025-4528 Description: These vulnerabilities exist in the NGC Explorer software developed by Digito Tecnologia S.A. Impact: May lead to information disclosure and unauthorized access. Affected Products Affected Products: NGC Explorer versions 3.48.21 and below. Unaffected Products: UNA and GUARDIÃO products. Remediation Steps 1. Update Software Immediately: - Upgrade NGC Explorer to version 3.48.22 or higher, available exclusively on Digito Tecnologia S.A.’s official website. - Verify the integrity of the update files and contact official Digito representatives before applying any updates. 2. Restrict Access and Implement Network Isolation: - Block all external/remote access to the management interfaces of Digito devices (including NGC Explorer, UNA, and Guardião, even if unaffected). - Ensure management interfaces are not exposed to the internet or unisolated networks. - Configuration, maintenance, or auditing should primarily be performed via physical/direct access (local console); use a VPN with strict access controls when necessary. 3. Monitor Networks and Firewall Rules: - Monitor for anomalous communications, particularly those involving Digito devices. - Implement firewall rules to prevent remote management protocols (SSH, RDP, HTTP/HTTPS management interfaces, etc.) from accessing Guardião, UNA, or NGC Explorer systems from external networks. 4. Additional Recommendations: - Minimize the exposure of management interfaces. - Implement network isolation (separating the management network from user and internet networks). - Continuously monitor logs and access attempts. - Verify update integrity in collaboration with the manufacturer. 5. Incident Reporting: - If any anomalous communications, unauthorized access attempts, or credential leaks are detected, immediately report them to CTIR Gov via email at ctir@ctir.gov.br. Additional Information Publication Date: December 9, 2025 Last Updated: December 19, 2025 Issuing Organization: CTIR Gov – National Cyber Incident Prevention, Handling, and Response Center Code Blocks No Proof-of-Concept (POC) code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Digito NGC Explorer CVE-2025-4527/4528 Vulnerability Advisory