{"id":"CVE-2025-2185","state":"PUBLISHED","title":"ALBEDO Telecom Net.Time - PTP/NTP Clock Insufficient Session Expiration","description":"ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which\n could permit an attacker to transmit passwords over unencrypted \nconnections, resulting in the product becoming vulnerable to \ninterception.","publishedAt":"2025-04-24T23:22:35.146Z","updatedAt":"2025-04-25T16:02:29.038Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P)"],"affected":[{"vendor":"ALBEDO Telecom","product":"Net.Time - PTP/NTP clock (Serial No. NBC0081P)","defaultStatus":"unaffected","versions":[{"version":"1.4.4","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-02","https://www.albedotelecom.com/contactus.php"],"weaknesses":["CWE-613"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2185.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-2185","state":"PUBLISHED","datePublished":"2025-04-24T23:22:35.146Z","dateUpdated":"2025-04-25T16:02:29.038Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-03-10T19:07:16.013Z"},"containers":{"cna":{"title":"ALBEDO Telecom Net.Time - PTP/NTP Clock Insufficient Session Expiration","descriptions":[{"lang":"en","value":"ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which\n could permit an attacker to transmit passwords over unencrypted \nconnections, resulting in the product becoming vulnerable to \ninterception."}],"affected":[{"vendor":"ALBEDO Telecom","product":"Net.Time - PTP/NTP clock (Serial No. NBC0081P)","defaultStatus":"unaffected","versions":[{"version":"1.4.4","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-02"},{"url":"https://www.albedotelecom.com/contactus.php"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.5,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","description":"CWE-613 Insufficient Session Expiration","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-04-24T23:22:35.146Z"},"credits":[{"lang":"en","type":"finder","value":"Khalid Markar, Parul Sindhwad & Dr. Faruk Kazi from CoE-CNDS Lab reported this vulnerability to CISA."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>ALBEDO Telecom has identified the following mitigations users can apply to reduce risk:</p>\n<ul>\n<li>Net.Time - PTP/NTP clock (Serial No. NBC0081P) Software release 1.4.4: Update to v1.6.1</li>\n</ul>\n<p>For more information, please <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.albedotelecom.com/contactus.php\">contact ALBEDO Telecom.</a></p>\n\n<br>"}],"value":"ALBEDO Telecom has identified the following mitigations users can apply to reduce risk:\n\n\n\n  *  Net.Time - PTP/NTP clock (Serial No. NBC0081P) Software release 1.4.4: Update to v1.6.1\n\n\n\n\nFor more information, please  contact ALBEDO Telecom. https://www.albedotelecom.com/contactus.php"}],"source":{"advisory":"ICSA-25-114-02","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-25T15:38:52.881020Z","id":"CVE-2025-2185","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-25T16:02:29.038Z"}}]}}}