CVE-2025-34427

MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local authenticated user with read access to this file can recover all user passwords and super-admin credentials, then use them to authenticate to MailEnable services such as POP3, SMTP, or the webmail interface, enabling unauthorized mailbox access and administrative control.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://mailenable.com/Standard-ReleaseNotes.txt	Release Notes
https://www.mailenable.com/	Product
https://www.vulncheck.com/advisories/mailenable-cleartext-credential-storage-in-auth-tab	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) MailEnable versiones anteriores a 10.54 contienen una vulnerabilidad de almacenamiento en texto claro de credenciales que puede conducir a compromiso de credenciales local y toma de control de la cuenta. El producto almacena contraseñas de usuario y administrativas en texto plano dentro de AUTH.TAB con acceso al sistema de archivos excesivamente permisivo. Un usuario autenticado local con acceso de lectura a este archivo puede recuperar todas las contraseñas de usuarios y credenciales de super?administrador, y luego utilizarlas para autenticarse a los servicios de MailEnable, como POP3, SMTP o la interfaz webmail, permitting acceso no autorizado a buzones y control administrativo.

Information

Published : 2025-12-10 19:16

Updated : 2026-10-14 21:10

NVD link : CVE-2025-34427

Mitre link : CVE-2025-34427

CVE.ORG link : CVE-2025-34427

JSON object : View

Products Affected

mailenable

mailenable

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2025-34427", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34427", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T18:55:36.415011Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "MailEnable", "product": "MailEnable", "versions": [{"status": "affected", "version": "0", "lessThan": "10.54", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-10T19:16:13.403", "references": [{"url": "https://mailenable.com/Standard-ReleaseNotes.txt", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.mailenable.com/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/mailenable-cleartext-credential-storage-in-auth-tab", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local authenticated user with read access to this file can recover all user passwords and super-admin credentials, then use them to authenticate to MailEnable services such as POP3, SMTP, or the webmail interface, enabling unauthorized mailbox access and administrative control."}, {"lang": "es", "value": "MailEnable versiones anteriores a 10.54 contienen una vulnerabilidad de almacenamiento en texto claro de credenciales que puede conducir a compromiso de credenciales local y toma de control de la cuenta. El producto almacena contrase\u00f1as de usuario y administrativas en texto plano dentro de AUTH.TAB con acceso al sistema de archivos excesivamente permisivo. Un usuario autenticado local con acceso de lectura a este archivo puede recuperar todas las contrase\u00f1as de usuarios y credenciales de super?administrador, y luego utilizarlas para autenticarse a los servicios de MailEnable, como POP3, SMTP o la interfaz webmail, permitting acceso no autorizado a buzones y control administrativo."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "E4DAB799-EDB6-48D7-A7FD-77D9910CB308", "versionEndExcluding": "10.54"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}