PT-2026-1819 · Unknown+1 · Appconnector+1

Published 2026-01-08 · Updated 2026-01-09 · CVE-2025-56425

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions enaio versions 10.10.0.183 and earlier enaio versions 11.0.0.183 and earlier enaio versions 11.10.0.183 and earlier

Description The AppConnector component is susceptible to command injection. Authenticated remote attackers can inject arbitrary SMTP commands through crafted input provided to the /osrest/api/organization/sendmail endpoint. The sendmail API endpoint accepts crafted input that allows for the injection of SMTP commands.

Recommendations Update the AppConnector component to a version later than 10.10.0.183 for enaio 10.10. Update the AppConnector component to a version later than 11.0.0.183 for enaio 11.0. Update the AppConnector component to a version later than 11.10.0.183 for enaio 11.10.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-56425

Affected Products

Appconnector

Enaio

References · 6

• 🔥 https://mind-bytes.de/smtp-injection-in-enaio-component-appconnector-cve-2025-56425 · Exploit
• https://osv.dev/vulnerability/CVE-2025-56425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56425 · Security Note
• https://twitter.com/CVEnew/status/2009462370201120936 · Twitter Post
• https://optimal-systems.de/enaio · Note
• https://twitter.com/TheHackerWire/status/2009716334477901998 · Twitter Post