What is the CVSS score of CVE-2025-58107?

CVE-2025-58107 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Samsung are affected by CVE-2025-58107?

Microsoft Exchange servers up to version 2019 are vulnerable to cleartext transmission of sensitive information, exposing credentials and email data to network-based interception attacks.

How to fix or mitigate CVE-2025-58107?

Within 24 hours: Identify all Exchange servers running versions up to 2019 and isolate them from untrusted networks; disable unnecessary protocols transmitting cleartext (HTTP, IMAP unencrypted, POP3 unencrypted). Within 7 days: Enforce TLS/SSL encryption for all Exchange communications; implement network segmentation to restrict Exchange access to authorized users and systems only; audit recent access logs for suspicious activity. Within 30 days: Plan and execute upgrade to Exchange 2019 CU14+ or Exchange Server 2021/2022 with all security updates; review and enforce strong authentication (MFA) for all Exchange accounts.

Samsung CVE-2025-58107

HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-03-02 cve@mitre.org

Samsung Microsoft

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 15:16 nvd

HIGH 7.5

DescriptionNVD

In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password.

AnalysisAI

In Microsoft Exchange versions up to 2019 is affected by cleartext transmission of sensitive information (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-319: Cleartext Transmission of Sensitive Information) affects In Microsoft Exchange. In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password.

Affected ProductsAI

Product: In Microsoft Exchange. Versions: up to 2019.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More from same product – last 7 days

CVE-2026-40412 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil

CVE-2026-41104 CRITICAL Monitor

10.0 May 22

Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal

CVE-2026-23652 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-

CVE-2026-47280 CRITICAL Monitor

10.0 May 22

Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti

CVE-2026-42901 CRITICAL Monitor

10.0 May 22

Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain

CVE-2025-58107 vulnerability details – vuln.today

Back

Samsung CVE-2025-58107

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

More from same product – last 7 days

Share

External POC / Exploit Code