CVE-2025-22495 Command injection in Network M2
Authenticated high-privileged users can execute arbitrary commands via improper input validation in the NTP configuration of the end-of-life Network-M2 card.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-22495?
CVE-2025-22495 is a high-severity command injection vulnerability in Eaton Network M2, published on 24 Feb 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. Note - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.
Weakness: CWE-78
Which versions are affected by CVE-2025-22495?
How do I fix CVE-2025-22495?
No fix has been published for CVE-2025-22495 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-22495 being exploited?
There is no known exploitation of CVE-2025-22495 in the wild and no public exploit code.
Sources
Also known as GHSA-pjqh-q2j4-8c7q.