CVE-2025-56425

{
  "id": "CVE-2025-56425",
  "sourceIdentifier": "[email protected]",
  "published": "2026-01-08T17:15:47.957",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version 11.0.0.183 and earlier of enaio 11.0, and in the AppConnctor component version 11.10.0.183 and earlier of enaio 11.10. The vulnerability allows authenticated remote attackers to inject arbitrary SMTP commands via crafted input to the /osrest/api/organization/sendmail endpoint"
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en el componente AppConnector versión 10.10.0.183 y anteriores de enaio 10.10, en el componente AppConnector versión 11.0.0.183 y anteriores de enaio 11.0, y en el componente AppConnctor versión 11.10.0.183 y anteriores de enaio 11.10. La vulnerabilidad permite a atacantes remotos autenticados inyectar comandos SMTP arbitrarios mediante una entrada manipulada al endpoint /osrest/API/organization/sendmail."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-01-09T17:51:52.624483Z",
          "id": "CVE-2025-56425",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:optimal-systems:enaio:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "10.10.0.0",
              "versionEndExcluding": "10.10.0.183",
              "matchCriteriaId": "F788DEB2-E18F-4EBF-AF0B-1DC8F4A8D7C9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:optimal-systems:enaio:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.0.0.0",
              "versionEndExcluding": "11.0.0.183",
              "matchCriteriaId": "0C7B7328-C113-411C-B67A-A1B0D1451BEA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:optimal-systems:enaio:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.10.0.0",
              "versionEndExcluding": "11.10.0.183",
              "matchCriteriaId": "B2F05785-8670-4576-9DFC-6E9C44C7D634"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://mind-bytes.de/smtp-injection-in-enaio-component-appconnector-cve-2025-56425/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.optimal-systems.de/enaio",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}