PT-2025-36721 · Smseagle · Smseagle

Vincent Salvadori · Published 2025-09-09 · Updated 2025-09-09 · CVE-2025-10095

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: SMSEagle versions prior to 6.11

Description: A SQL injection vulnerability exists in the SMPP server component of the SMSEagle firmware. The issue stems from improper sanitization of user input in the server's scripts during database interactions. This vulnerability is isolated to the SMPP server and its dedicated database, limiting the scope of impact to SMPP server operations.

Recommendations: Update to version 6.11 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10095

Affected Products

Smseagle

References · 8

• https://smseagle.eu/security-advisory/resolved-sql-injection-in-smpp-component-of-smseagle-software-6-11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10095 · Security Note
• https://t.me/cveNotify/134742 · Telegram Post
• https://cert.pl/en/posts/2025/09/CVE-2025-10095 · Note
• https://t.me/CVEtracker/32065 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1965484511937847573 · Twitter Post
• https://twitter.com/CVEnew/status/1965364106279473547 · Twitter Post
• https://cert.pl/en/posts/2025/08/CVE-2025-10095 · Note