SQL Injection Vulnerability in SMSEagle Firmware's SMPP Server Component
CVE-2025-10095

5.3MEDIUM

Key Information:

Vendor

Proximus Sp. Z O.o.

Status
Smseagle
Vendor
CVE Published:
9 September 2025

What is CVE-2025-10095?

A vulnerability has been found in the SMPP server component of SMSEagle firmware, which affects how certain parameters are processed during database interactions. This SQL injection issue results from insufficient sanitization of user inputs, posing a risk exclusively to the operations of the SMPP server, as it uses a dedicated database distinct from the main software’s database. The flaw has been addressed in version 6.11 of the firmware, mitigating the potential for exploitation through this vector.

Affected Version(s)

SMSEagle 0 < 6.11

References

https://cert.pl/en/posts/2025/08/CVE-2025-10095
third-party-advisory
https://www.smseagle.eu/security-advisory/resolved-sql-in...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vincent Salvadori
.
CVE-2025-10095 : SQL Injection Vulnerability in SMSEagle Firmware's SMPP Server Component