Vulnerability in Mici Network Co. Ltd. Netfax Server

CVE-2025-48046

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.

EPSS: 0.005 (37.8th percentile) — read the EPSS interpretation.

Affected products

Mici Network Co. Ltd. Netfax Server — versions 0

Weakness classification (CWE)

CWE-256 — Plaintext Storage of a Password

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cve@rapid7.com (third-party-advisory)

Frequently asked questions

What is CVE-2025-48046?: CVE-2025-48046 is a vulnerability in Mici Network Co. Ltd. Netfax Server, classified under Plaintext Storage of a Password. Published 2025-05-29.
Is CVE-2025-48046 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.