CVE-2025-48046: SMTP Server Password Disclosure Vulnerability

CVE-2025-48046 Overview

CVE-2025-48046 is an information disclosure vulnerability affecting MICI NetFax Server. An authenticated user can retrieve the cleartext password of a configured Simple Mail Transfer Protocol (SMTP) server by issuing an HTTP GET request to the /config.php endpoint. The flaw is categorized under [CWE-256] (Plaintext Storage of a Password). The vendor has not released a fix at the time of publication.

Critical Impact
Any authenticated user of the NetFax administrative interface can extract cleartext SMTP credentials, enabling lateral movement into mail infrastructure and follow-on phishing or data exfiltration campaigns.

Affected Products

MICI NetFax Server (all versions as of disclosure)
Web administration component exposing /config.php
Configurations using an SMTP relay for outbound email or fax notifications

Discovery Timeline

2025-05-29 - Rapid7 publishes coordinated advisory covering CVE-2025-48045, CVE-2025-48046, and CVE-2025-48047
2025-05-29 - CVE CVE-2025-48046 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48046

Vulnerability Analysis

The MICI NetFax Server stores SMTP relay credentials in a form that permits retrieval in plaintext. When an authenticated user requests /config.php over HTTP, the server returns configuration values including the SMTP password. This exposes credentials that should be protected by one-way hashing, encryption at rest, or write-only administrative forms. The issue falls under the Information Disclosure class and specifically Plaintext Storage of a Password.

The vulnerability requires low-privilege authentication rather than administrator rights. Any account able to reach the /config.php endpoint can harvest the credential. Rapid7 reports the vendor has not issued a patch, leaving deployed devices exposed until compensating controls are applied.

Root Cause

The root cause is insecure credential storage combined with an administrative endpoint that echoes stored passwords back to the client instead of masking or omitting them. Configuration pages should never return secret material in server responses.

Attack Vector

Exploitation is remote and network-based. An attacker with valid low-privilege credentials, or an attacker who has obtained a valid session through credential stuffing or phishing, sends an HTTP GET request to /config.php and parses the SMTP password from the response body. Recovered credentials can then be used to authenticate to the SMTP server, send spoofed mail from a trusted domain, or pivot into linked mailboxes.

See the Rapid7 advisory on MICI NetFax Server vulnerabilities for technical detail on the endpoint behavior.

Detection Methods for CVE-2025-48046

Indicators of Compromise

HTTP GET requests to /config.php from user accounts that do not normally administer the NetFax device
Access to /config.php from IP addresses outside the management network or during off-hours
SMTP authentication events from the NetFax SMTP account originating from hosts other than the fax server itself
Unexpected outbound mail volume from the configured SMTP relay account

Detection Strategies

Enable HTTP access logging on the NetFax web interface and alert on any read of /config.php
Correlate NetFax web session activity with subsequent SMTP authentication events for the same credential
Baseline the source IPs and user agents that legitimately access the configuration endpoint and alert on deviations

Monitoring Recommendations

Ingest NetFax web server logs and SMTP relay logs into a centralized SIEM for correlation
Monitor for outbound SMTP AUTH sequences that use the fax server credential from unexpected clients
Track failed login attempts against the NetFax administrative interface to identify brute-force precursors

How to Mitigate CVE-2025-48046

Immediate Actions Required

Restrict network access to the NetFax web administration interface to a dedicated management VLAN or jump host
Rotate the SMTP account password stored on the NetFax device and audit recent usage of that credential
Review and reduce the set of accounts able to authenticate to the NetFax web interface
Enable multi-factor authentication on the upstream SMTP relay where supported to limit the value of a leaked password

Patch Information

Rapid7 reports that the vendor has not released a fix for CVE-2025-48046. Monitor MICI communications for an updated firmware release and apply it as soon as it becomes available. Until then, treat compensating controls as the primary defense.

Workarounds

Place the NetFax device behind a reverse proxy or firewall that limits /config.php to administrator source addresses
Use a dedicated, low-privilege SMTP relay account scoped only to fax notifications so credential exposure has minimal downstream impact
Segment the NetFax server from general user networks to reduce the population of accounts that can reach the web interface
Disable or remove user accounts on the NetFax device that do not require administrative access

bash

# Example firewall rule restricting /config.php access to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP