Description
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MICI Network | NetFax Server | < 3.0.1.0 | 3.0.1.0 |
Medium · 5.3
CVE-2025-48046
EUVD-2025-16372GHSA-hfcm-596p-c7f7
MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext
Published May 29, 2025 · Updated Sep 5, 2025 · Assigned by rapid7