Cleartext Credential Storage Vulnerability in MailEnable

CVE-2025-34428

What is CVE-2025-34428?

MailEnable versions before 10.54 are susceptible to a vulnerability that results in the insecure storage of user and administrative credentials in plaintext format. The AUTH.SAV file, which holds these credentials, has excessive filesystem permissions that allow local authenticated users to access its contents. This exposure enables an attacker to recover all user passwords and super-admin credentials. If exploited, these credentials can facilitate unauthorized access to MailEnable services including POP3, SMTP, and webmail, leading to potential mailbox access and administrative control for malicious actors.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References