HGiga MailSherlock - Broken Authentication
Priority MEDIUM 45CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.
Why it matters now
EPSS 0.01674 76th percentileScored 2026-11-07
Fix Fixed MailSherlock MSR45/SSR45 (HGiga): 243, 114, 122 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HGiga | MailSherlock MSR45/SSR45 | before 243 | 243 | Patch available | CNA |
| HGiga | MailSherlock MSR45/SSR45 | before 114 | 114 | Patch available | CNA |
| HGiga | MailSherlock MSR45/SSR45 | before 122 | 122 | Patch available | CNA |
| HGiga | MailSherlock MSR45/SSR45 | before 143 | 143 | Patch available | CNA |
| HGiga | MailSherlock MSR45/SSR45 | before 130 | 130 | Patch available | CNA |
- MailSherlock MSR45/SSR45 VendorHGiga Affected before 243 Fixed in 243 Patch available CNA
- MailSherlock MSR45/SSR45 VendorHGiga Affected before 114 Fixed in 114 Patch available CNA
- MailSherlock MSR45/SSR45 VendorHGiga Affected before 122 Fixed in 122 Patch available CNA
- MailSherlock MSR45/SSR45 VendorHGiga Affected before 143 Fixed in 143 Patch available CNA
- MailSherlock MSR45/SSR45 VendorHGiga Affected before 130 Fixed in 130 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hgiga:msr45_isherlock-antispam:*:*:*:*:*:*:*:* | before 4.5-130 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:msr45_isherlock-audit:*:*:*:*:*:*:*:* | before 4.5-143 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:msr45_isherlock-base:*:*:*:*:*:*:*:* | before 4.5-243 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:* | before 4.5-114 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:msr45_isherlock-useradmin:*:*:*:*:*:*:*:* | before 4.5-122 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:ssr45_isherlock-antispam:*:*:*:*:*:*:*:* | before 4.5-130 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:ssr45_isherlock-audit:*:*:*:*:*:*:*:* | before 4.5-143 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:ssr45_isherlock-base:*:*:*:*:*:*:*:* | before 4.5-243 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:* | before 4.5-114 | Vulnerable | HGiga |
| cpe:2.3:a:hgiga:ssr45_isherlock-useradmin:*:*:*:*:*:*:*:* | before 4.5-112 | Vulnerable | HGiga |
- cpe:2.3:a:hgiga:msr45_isherlock-antispam:*:*:*:*:*:*:*:* Versions before 4.5-130 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:msr45_isherlock-audit:*:*:*:*:*:*:*:* Versions before 4.5-143 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:msr45_isherlock-base:*:*:*:*:*:*:*:* Versions before 4.5-243 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-114 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:msr45_isherlock-useradmin:*:*:*:*:*:*:*:* Versions before 4.5-122 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:ssr45_isherlock-antispam:*:*:*:*:*:*:*:* Versions before 4.5-130 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:ssr45_isherlock-audit:*:*:*:*:*:*:*:* Versions before 4.5-143 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:ssr45_isherlock-base:*:*:*:*:*:*:*:* Versions before 4.5-243 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-114 Vulnerable ·HGiga
- cpe:2.3:a:hgiga:ssr45_isherlock-useradmin:*:*:*:*:*:*:*:* Versions before 4.5-112 Vulnerable ·HGiga
Remediation
- Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 243
- Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 114
- Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 122
- Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 143
- Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 130
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25848
- 2026-10-03 Alias added: GHSA-qf9m-hx8v-j382
References
More HGiga Msr45 Isherlock-antispam vulnerabilities
- TI-2021-05709 HGiga MailSherlock - SQL Injection-2 CVSS 3.1CRITICAL 9.8
- TI-2020-18199 HGiga MailSherlock - SQL Injection -3 CVSS 3.1HIGH 7.6
- TI-2020-18198 HGiga MailSherlock - SQL Injection -1 CVSS 3.1HIGH 7.6
- TI-2020-18197 HGiga MailSherlock - XSS -2 CVSS 3.1HIGH 7.0
- TI-2020-18196 HGiga MailSherlock - XSS -1 CVSS 3.1HIGH 7.0
Sources
- CVE-2020-25848 · CVE Program
- CVE-2020-25848 · NVD
- FIRST EPSS
- GHSA-qf9m-hx8v-j382 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences