Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2025-52691

Published 2025-12-29

Updated 3 months ago

Vendor/s

SmarterTools

Product/s

SmarterMail

Version/s

\* > 100.0.9413

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

10

/ 10

Critical

Severity Details

Base score

10 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2025-52691 is a critical file upload vulnerability in SmarterTools SmarterMail (CVSS 10.0) allowing unauthenticated remote code execution.

## Why this matters

CVE-2025-52691 is a maximum-severity vulnerability (CVSS 10.0) in SmarterTools SmarterMail that allows unauthenticated attackers to upload arbitrary files anywhere on the mail server. Because this flaw enables remote code execution (RCE) without requiring user interaction, it represents an extreme risk to data confidentiality and system integrity. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog confirms that attackers are actively leveraging this flaw in the wild. Organizations using SmarterMail must prioritize remediation immediately to prevent full server compromise and potential lateral movement within the network.

## CPE

SmarterTools

| Product     | Version Start | Version End (excl.) | Status     |
| ----------- | ------------- | ------------------- | ---------- |
| smartermail | \*            | 100.0.9413          | vulnerable |

## Related weakness (CWE)

CWE-434

## Remediation plan

1

### Apply official patches

Download and install the latest security updates provided by SmarterTools specifically addressing the arbitrary file upload vulnerability in SmarterMail.

2

### Update affected systems

Ensure all SmarterMail instances are updated to version 100.0.9413 or later, as all versions prior to this build are confirmed to be vulnerable.

3

### Restrict access

Implement strict IP whitelisting for administrative interfaces and ensure the web server service account has minimal write permissions to non-essential directories.

4

### Monitor for exploitation

Audit the file system for unexpected .aspx, .exe, or script files in the SmarterMail installation directory and monitor for unauthorized web shell activity.

## Detection Guidance

Security teams should inspect web server access logs for unusual POST requests directed at file upload endpoints, particularly those originating from unknown IP addresses. Monitor for the creation of new, unauthorized files within the SmarterMail web root or temporary directories. Additionally, use EDR tools to detect suspicious child processes spawned by the SmarterMail web service (e.g., cmd.exe or powershell.exe) and alert on any unauthorized modifications to system configuration files.

## References

[https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ Third Party Advisory ](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/)[https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com Exploit Third Party Advisory ](https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2025-52691 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)