PT-2025-30302 · Unknown · Hmailserver

Eli Samara · Published 2025-07-21 · Updated 2025-07-21 · CVE-2025-52374

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions hMailServer versions 5.6.9-beta through 5.8.6

Description The software uses a hardcoded cryptographic key in the Encryption.cs file. This allows an attacker to decrypt passwords for other servers stored in the hMailAdmin.exe.config file, potentially granting access to other hMailServer admin consoles with configured connections.

Recommendations Update hMailServer to a version newer than 5.8.6.

Exploit

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2025-52374

Affected Products

Hmailserver

References · 6

• 🔥 https://github.com/mojibake-dev/mojibake-CVE/blob/main/hMailServer/CVE-2025-52374.md · Exploit
• 🔥 https://github.com/mojibake-dev/hMailEnum · Exploit
• https://osv.dev/vulnerability/CVE-2025-52374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52374 · Security Note
• https://github.com/hmailserver/hmailserver · Note
• https://twitter.com/CVEnew/status/1947331046883610754 · Twitter Post