🚨 CVE-2025-52691 — Critical SmarterMail Vulnerability

Status: 🔥 Critical — Immediate action required CVSS v3.1 Score: 10.0 / 10 Disclosure Date: December 29–30, 2025

🧩 Vulnerability Summary

CVE-2025-52691 is a critical, unauthenticated arbitrary file upload vulnerability affecting SmarterTools SmarterMail Server. Exploitation can lead directly to Remote Code Execution (RCE) and full server compromise.

🎯 Key Technical Details

CVSS Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

💥 What an Attacker Can Do

An unauthenticated remote attacker can:

✅ Upload arbitrary files to any server location ✅ Place malicious executables or web shells ✅ Execute arbitrary code on the mail server ✅ Gain full system control ✅ Abuse mail infrastructure for spam, phishing, or lateral movement

⚠️ Because mail servers are usually Internet-exposed, the real-world risk is extremely high.

🧨 Risk Assessment

Overall Risk Level: 🚨 CRITICAL

🛠️ Mitigation & Remediation (Urgent)

✅ Immediate Actions

1. Upgrade SmarterMail to Build 9413 or later
2. Restrict external access until patching is complete
3. Review server file systems for unexpected uploads
4. Check logs for suspicious POST/upload activity
5. Rotate credentials if compromise is suspected

🕵️ Exploitation Status

• 🚫 No widely published public PoC (as of now)

• ⚠️ High likelihood of active exploitation due to:

  • CVSS 10.0
  • Unauthenticated access
  • Internet-facing service
  • Simple attack path

🏷 Attribution

• CVE Assigned By: Cyber Security Agency (CSA), Singapore

• Referenced By:

  • NVD (NIST)
  • CSA Singapore
  • National CERT advisories (EU & APAC)

Here are the short steps to run the Nuclei detection template for CVE-2025-52691:

1. Save the template

   Copy the YAML into a file: cve-2025-52691.yaml

2. Install/Update Nuclei (if needed)

   root@kitploit:~

   go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
   

3. Run on a single target

   root@kitploit:~

   nuclei -t cve-2025-52691.yaml -u https://your-smartermail-domain.com
   

4. Run on multiple targets (from a file called targets.txt)

   root@kitploit:~

   nuclei -t cve-2025-52691.yaml -l targets.txt
   

5. Optional useful flags

   • -v → see more details
   • -o results.txt → save output
   • -silent → show only matches

That's it! If it finds a vulnerable version (< Build 9413), it will alert you.

Reminder: Only scan systems you own or have permission for. 😊