Vulnerabilities

TI-2025-30421 CVE-2025-48047 · GHSA-xhw7-r59x-5m6x

MICI Network Co. Ltd. NetFax Server Command Injection

HIGH 76

An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.1717 Published 2025-05-29 Fixed in 3.0.1.0 CWE-78

TI-2025-30420 CVE-2025-48046 · GHSA-hfcm-596p-c7f7

MEDIUM 57

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00532 Published 2025-05-29 Fixed in 3.0.1.0 CWE-256

TI-2025-30419 CVE-2025-48045 · GHSA-5pqc-8wc5-jxj6

HIGH 77

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00635 Published 2025-05-29 Fixed in 3.0.1.0 CWE-201