CVE-2025-56425

Name of the Vulnerable Software and Affected Versions enaio versions 10.10.0.183 and earlier enaio versions 11.0.0.183 and earlier enaio versions 11.10.0.183 and earlier

Description The AppConnector component is susceptible to command injection. Authenticated remote attackers can inject arbitrary SMTP commands through crafted input provided to the /osrest/api/organization/sendmail endpoint. The sendmail API endpoint accepts crafted input that allows for the injection of SMTP commands.

Recommendations Update the AppConnector component to a version later than 10.10.0.183 for enaio 10.10. Update the AppConnector component to a version later than 11.0.0.183 for enaio 11.0. Update the AppConnector component to a version later than 11.10.0.183 for enaio 11.10.