IceWarp CVE-2025-14499

Exploitation requires the attacker to craft input to the specific parameter processed by IceWarp's 'gmaps' webpage, and critically requires user interaction (CVSS UI:R): a logged-in or targeted IceWarp user must be lured into visiting a malicious page or opening a malicious file for the injected script to execute. No authentication is required of the attacker (PR:N), and the flaw is reachable over the network against the IceWarp web interface, so exposure is greatest for internet-facing IceWarp webmail/collaboration deployments. The primary limiting factor is the mandatory victim interaction - there is no autonomous or server-side-only trigger described - which makes this a social-engineering-dependent, targeted attack rather than a drive-by server compromise.

The input CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (UI:R). No EPSS score, CISA KEV entry, or public POC was provided in the intelligence set, so by the precision rules this is 'no public exploit identified at time of analysis' - note the source is a ZDI/Trend Micro coordinated advisory (ZDI-25-1071, formerly ZDI-CAN-25441), which indicates a researcher-reported and vendor-coordinated disclosure rather than observed in-the-wild activity. The signals are internally consistent for a client-side reflected-XSS-to-auth-bypass issue: high CVSS is driven by the unauthenticated network vector, but real-world exploitation is throttled by the UI:R requirement (a target must be lured to a crafted page/link). The description's claim of C:H/I:H/A:H is somewhat aggressive for a reflected XSS - the realistic impact is hijacking the victim's authenticated IceWarp session/identity (strong confidentiality and integrity against that account), while availability impact is questionable and not substantiated by the text. Net: a genuine, high-value issue for IceWarp operators because it defeats authentication, but it is a lure-dependent, targeted-style attack rather than a wormable mass-exploitation candidate; absent EPSS/KEV data, prioritize patching for internet-facing IceWarp deployments but treat it below any unauthenticated-no-UI RCE.

An attacker crafts a malicious link or web page that injects script via the vulnerable parameter handled by the IceWarp 'gmaps' webpage and sends it to a target (e.g., via phishing). When the victim visits the page, the injected script executes in the IceWarp web context and is leveraged to bypass authentication, giving the attacker access to the victim's authenticated session or account functions. No public exploit code was identified at the time of analysis; the issue is documented only in the ZDI advisory.