MailEnable CVE-2025-34428

Exploitation requires the attacker to already be a LOCAL, AUTHENTICATED user on the MailEnable host (PR:L, AV:L) with filesystem READ access to the AUTH.SAV file, which stores user and administrative passwords in plaintext under overly permissive ACLs. The limiting factors that reduce real-world risk: there is no remote/network path (local access is mandatory), the attacker needs an existing foothold or account on the server, and the issue is resolved in MailEnable 10.54 and later. Highest-impact targets are multi-tenant or shared-hosting deployments where multiple low-privileged users share the same filesystem.

Signals are consistent and point to a MODERATE, locally-scoped risk rather than an urgent remote-exploitation priority. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-privileged, authenticated attacker with high confidentiality and integrity impact (VC:H/VI:H), which matches the description precisely: a local authenticated user who can read AUTH.SAV recovers all plaintext credentials. EPSS is very low (0.12%, 2nd percentile) and the CVE is NOT on CISA KEV, with no public exploit code referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. These signals do not conflict: a local-only, authentication-required credential-disclosure flaw is inherently unsuitable for the mass internet-facing exploitation that drives high EPSS, so a low EPSS alongside a high 8.4 base score is expected rather than contradictory. The headline score is elevated mainly because recovered super-admin credentials escalate into full mailbox and administrative takeover, but realization depends on an attacker already having local, authenticated read access to the server filesystem. No SSVC decision data was provided in the input. Net: a genuine privilege-escalation/credential-exposure issue worth patching in managed/multi-tenant mail hosting, but not an emergency remote threat.

A low-privileged user with shell or file-read access to a MailEnable server (e.g., a shared-hosting tenant or a compromised low-tier account) opens the AUTH.SAV file, whose permissive filesystem ACLs let them read it. They extract the plaintext passwords of all mailbox users and the super-admin, then log into POP3, SMTP, or the webmail interface as any of those accounts to read mail and seize administrative control. No public exploit code is required or referenced - the attack is simply reading a file and reusing the credentials.