What is the CVSS score of CVE-2025-58107?

CVE-2025-58107 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2025-58107?

Microsoft Exchange servers up to version 2019 are vulnerable to cleartext transmission of sensitive information, exposing credentials and email data to network-based interception attacks.

How to fix or mitigate CVE-2025-58107?

Within 24 hours: Identify all Exchange servers running versions up to 2019 and isolate them from untrusted networks; disable unnecessary protocols transmitting cleartext (HTTP, IMAP unencrypted, POP3 unencrypted). Within 7 days: Enforce TLS/SSL encryption for all Exchange communications; implement network segmentation to restrict Exchange access to authorized users and systems only; audit recent access logs for suspicious activity. Within 30 days: Plan and execute upgrade to Exchange 2019 CU14+ or Exchange Server 2021/2022 with all security updates; review and enforce strong authentication (MFA) for all Exchange accounts.

Microsoft CVE-2025-58107

HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-03-02 cve@mitre.org

Microsoft Samsung

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 15:16 nvd

HIGH 7.5

DescriptionCVE.org

In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password.

AnalysisAI

In Microsoft Exchange versions up to 2019 is affected by cleartext transmission of sensitive information (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-319: Cleartext Transmission of Sensitive Information) affects In Microsoft Exchange. In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password.

Affected ProductsAI

Product: In Microsoft Exchange. Versions: up to 2019.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Samsung

View all

CVE-2024-7399 HIGH Act Now POC

8.8 Aug 12

Arbitrary file write as SYSTEM in Samsung MagicINFO 9 Server before version 21.1050 allows remote attackers to place att

CVE-2025-4632 CRITICAL Act Now POC

9.8 May 13

Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary

CVE-2012-4333 CRITICAL Emergency POC

10.0 Aug 14

Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0

CVE-2017-16524 HIGH Act Now POC

8.8 Nov 06

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u

CVE-2015-8279 HIGH Act Now POC

8.6 Jan 15

Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an un

CVE-2017-17692 HIGH Act Now POC

7.5 Dec 21

Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat

CVE-2012-6429 CRITICAL Emergency POC

10.0 Apr 04

Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7

CVE-2012-4329 HIGH Act Now POC

7.8 Aug 14

The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart

CVE-2012-4330 HIGH Act Now POC

7.8 Aug 14

The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long

CVE-2012-4334 CRITICAL Emergency POC

10.0 Aug 14

The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i v

CVE-2015-5473 CRITICAL Emergency

9.8 Jun 01

Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary

CVE-2012-4250 CRITICAL Emergency POC

9.3 Aug 13

Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls

Same weakness CWE-319 – Cleartext Transmission of Sensitive Information

View all

CVE-2025-26199 CRITICAL POC

9.8

CVE-2025-32880 CRITICAL POC

9.8

CVE-2023-33730 CRITICAL POC

9.8

CVE-2019-15911 CRITICAL POC

9.8

CVE-2019-18852 CRITICAL POC

9.8

CVE-2024-25735 CRITICAL POC

9.1

CVE-2023-23914 CRITICAL POC

9.1

CVE-2024-50634 HIGH POC

8.8

CVE-2025-58107 vulnerability details – vuln.today

Back

Microsoft CVE-2025-58107

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

More in Samsung

Same weakness CWE-319 – Cleartext Transmission of Sensitive Information

Share

External POC / Exploit Code