CVE-2025-10095
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-10
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| smseagle | smseagle_firmware | <6.11 |
| smseagle | smpp_server | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL injection issue in the SMPP server component of SMSEagle firmware versions before 6.11. It occurs because the SMPP server does not properly sanitize user input parameters when interacting with its dedicated database. This allows an attacker to inject malicious SQL commands into the database queries, potentially manipulating or accessing data within the SMPP server's database. [1]
How can this vulnerability impact me? :
The vulnerability can allow an attacker to perform SQL injection attacks on the SMPP server's dedicated database, potentially leading to unauthorized access or manipulation of data related to SMPP server operations. However, since the SMPP server uses a separate database from the main software, the impact is limited to SMPP server functions. The security impact is rated Medium with low confidentiality impact and no integrity or availability impact. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update all SMSEagle devices to software version 6.11 or later, as the issue is fixed in that version. Updates can be performed via the web GUI or by contacting SMSEagle support for offline update packages. [1]