CVE-2025-42599

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 3,3%

Kerentanan Stack-based Buffer Overflow pada qualitia active! mail. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 28 April 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.

Rincian

Terbit di NVD

18 April 2025

Terakhir diubah

24 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

3,3% peluang dieksploitasi; lebih tinggi dari 88,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Masuk KEV

28 April 2025

Tenggat CISA

19 Mei 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.qualitia.com/jp/news/2025/04/18_1030.html advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42599 pemerintah AS
• https://jvn.jp/en/jp/JVN22348866/ advisory pihak ketiga