CVE-2025-30189

Real-world risk assessment reveals moderate-to-high priority despite contradictory signals. The CVSS 7.4 (High) score reflects significant impact with high confidentiality and integrity compromise, though attack complexity is rated High (AC:H) suggesting specific preconditions are required. The vulnerability requires no authentication (PR:N) and is network-accessible (AV:N), making it broadly exploitable once preconditions are met. However, EPSS exploitation probability is extremely low at 0.03% (9th percentile), indicating security researchers assess real-world exploitation as unlikely. No public exploit code exists and the vulnerability is not confirmed actively exploited (not in CISA KEV). The high attack complexity likely stems from requiring specific passdb/userdb driver configurations with caching enabled and circumstances where cache key collisions occur. SSVC considerations indicate moderate technical impact (unauthorized account access) but low automation potential due to configuration-specific nature. Priority should be elevated for organizations running Dovecot with passdb/userdb caching enabled in multi-user environments, particularly email service providers. The discrepancy between high CVSS and low EPSS suggests this is primarily a vulnerability of concern for specific deployment patterns rather than mass exploitation scenarios.

An attacker targets a mail server running Dovecot with passdb caching enabled and a vulnerable driver configuration. The attacker first waits for or triggers a legitimate user (victim@example.com) to authenticate successfully, causing their authentication state to be cached with a non-unique cache key. The attacker then attempts authentication to the mail server using their own credentials (attacker@example.com), which generates an identical cache key due to the driver misconfiguration. Dovecot retrieves the cached authentication state from the victim's previous login instead of validating the attacker's actual credentials. The attacker gains full access to the victim's mailbox, can read confidential emails, send messages as the victim, and access any email-based password reset mechanisms for other services. The attack complexity is high because it requires knowledge of the specific caching configuration, timing the attack after a target user's authentication, and potentially discovering which usernames share cache key collisions.