MailEnable CVE-2025-34422

Exploitation requires the attacker to already have LOCAL write access to the MailEnable installation directory and relies on the administrative executable's insecure DLL search order loading MEAIPC.DLL without integrity validation. Key limiting factors: the attack is local-only (not remotely reachable), requires existing low-level privileges sufficient to write into the install directory (normally a protected path), and requires the vulnerable admin executable to actually be executed after the rogue DLL is planted. Fixed in MailEnable 10.54; only the 'standard' edition is confirmed affected by the available CPE.

This is a locally-exploitable DLL hijacking flaw (CWE-427) in MailEnable's administrative executable, and the signals consistently point to a moderate, not emergency, priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack is LOCAL and requires the attacker to already hold some privileges - specifically write access to the MailEnable installation directory - which is the dominant limiting factor. EPSS is very low (0.17%, 6th percentile), MailEnable is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The high impact scores (VC:H/VI:H/VA:H) reflect that successful exploitation yields full code execution with the process's privileges - effectively a local privilege-escalation / persistence primitive rather than a remote compromise. There is no conflict between the signals: all of them (local vector, low EPSS, no KEV, no POC) agree this is a real but low-urgency, pre-conditioned issue rather than a high-CVSS-but-overstated remote threat. Note the headline score of 8.5 is a CVSS 4.0 value driven by the triple-high impact; the real-world risk is gated almost entirely by the requirement for pre-existing local write access to a protected directory.

An attacker who already has a foothold on the MailEnable server and write access to the installation directory plants a malicious MEAIPC.DLL there. When an administrator (or a scheduled/service process) subsequently runs the MailEnable administrative executable, the rogue DLL is loaded due to the insecure search order, executing attacker code with that process's privileges - typically a local privilege escalation to the service/admin context. No public exploit is identified at time of analysis, but DLL-planting techniques are trivially reproducible.