CVE-2025-48045 Overview
CVE-2025-48045 is an information disclosure vulnerability in the MICI NetFax Server. An unauthenticated HTTP GET request to the /client.php endpoint returns the default administrator user credentials in the response. The flaw maps to [CWE-201: Insertion of Sensitive Information Into Sent Data] and requires no authentication, user interaction, or special privileges. Public details were published by Rapid7 on May 29, 2025, alongside CVE-2025-48046 and CVE-2025-48047. According to the disclosure, the vendor has not released a fix.
Critical Impact
Any network-reachable attacker can retrieve administrator credentials with a single HTTP request, leading to full administrative takeover of the NetFax appliance.
Affected Products
- MICI NetFax Server (web management interface)
- Deployments exposing /client.php over HTTP/HTTPS
- Appliances using factory-default administrator accounts
Discovery Timeline
- 2025-05-29 - Rapid7 publishes coordinated disclosure covering CVE-2025-48045, CVE-2025-48046, and CVE-2025-48047, noting the issues are unfixed by the vendor
- 2025-05-29 - CVE-2025-48045 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-48045
Vulnerability Analysis
The MICI NetFax Server exposes a web management interface that includes the /client.php resource. This endpoint responds to HTTP GET requests without enforcing any authentication check. The response body contains the default administrator credentials used by the appliance. An attacker on the same network segment, or anyone able to reach the device over the internet, can issue a single GET request and parse the credentials from the response.
Because the credentials returned are the default administrator account, the disclosure directly enables authenticated administrative access through the standard login flow. From there, an attacker can read fax traffic, modify routing, alter user accounts, and pivot to other systems that trust the appliance.
Root Cause
The root cause is missing access control on a server-side script that handles or references sensitive configuration data. The /client.php handler does not validate the requester's session before serving content that includes credential material. This is a design-level failure consistent with CWE-201, where sensitive information is embedded into responses that should never carry it.
Attack Vector
Exploitation is performed over the network with no preconditions. An attacker sends a single unauthenticated HTTP GET to https://<target>/client.php and parses the response for the administrator username and password. The retrieved credentials are then replayed against the appliance's normal authentication endpoint to obtain a privileged session. No exploit toolkit is required; standard HTTP clients such as curl or wget are sufficient.
See the Rapid7 disclosure for MICI NetFax Server vulnerabilities for additional technical context.
Detection Methods for CVE-2025-48045
Indicators of Compromise
- HTTP GET requests to /client.php from external or unexpected internal sources in web server access logs
- Successful administrator logins originating from IP addresses that previously requested /client.php
- Configuration changes, new user accounts, or modified fax routing rules on the NetFax appliance with no corresponding change request
- Outbound connections from the appliance to unfamiliar hosts following credential disclosure
Detection Strategies
- Alert on any request to /client.php from outside an explicit administrator allowlist
- Correlate /client.php requests with subsequent administrator authentication events from the same source IP
- Hunt historical proxy and firewall logs for GET /client.php patterns to identify prior exposure
Monitoring Recommendations
- Forward NetFax web server and authentication logs to a central log platform for retention and search
- Baseline normal administrative access patterns and alert on deviations such as off-hours logins
- Monitor egress from the appliance segment to detect post-compromise lateral movement
How to Mitigate CVE-2025-48045
Immediate Actions Required
- Remove the NetFax management interface from any internet-facing exposure and restrict access to a dedicated management VLAN
- Place the appliance behind a reverse proxy or firewall rule that blocks unauthenticated requests to /client.php
- Rotate the default administrator credentials and disable the default account where the product allows it
- Review authentication and configuration logs for signs of prior exploitation
Patch Information
At the time of publication, Rapid7 reports that the vendor has not issued a fix for CVE-2025-48045. Organizations should treat this as an unpatched vulnerability and rely on network-level controls until the vendor releases a patched firmware build. Monitor the Rapid7 advisory and vendor channels for updates.
Workarounds
- Block external access to /client.php at the upstream web application firewall or load balancer
- Require VPN or jump-host access for all administrative interactions with the appliance
- Apply source IP allowlisting on the management interface so only authorized administrator workstations can reach it
- If feasible, decommission affected appliances and migrate to a maintained fax solution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
