CVE-2025-42599
📋 TL;DR
CVE-2025-42599 is a critical stack-based buffer overflow vulnerability in Active! mail 6 that allows remote unauthenticated attackers to execute arbitrary code or cause denial-of-service by sending specially crafted requests. This affects all systems running Active! mail 6 version 6.60.05008561 and earlier. The vulnerability is particularly dangerous because it requires no authentication and has a CVSS score of 9.8.
💻 Affected Systems
- Active! mail 6
📦 What is this software?
Active\! Mail by Qualitia
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Denial-of-service causing mail service disruption, potentially followed by remote code execution for further system exploitation.
If Mitigated
Service disruption with limited lateral movement if proper network segmentation and least privilege controls are implemented.
🎯 Exploit Status
CISA has added this to their Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The buffer overflow nature suggests relatively straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 6.60.05008562 or later
Vendor Advisory: https://www.qualitia.com/jp/news/2025/04/18_1030.html
Restart Required: Yes
Instructions:
1. Download the latest version from the vendor website. 2. Backup current configuration and data. 3. Stop the Active! mail service. 4. Install the updated version. 5. Restart the service. 6. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Active! mail server to only trusted sources
Firewall Rules
windowsBlock external access to Active! mail ports using firewall rules
netsh advfirewall firewall add rule name="Block ActiveMail" dir=in action=block protocol=TCP localport=25,110,143,587,993,995
🧯 If You Can't Patch
- Isolate the Active! mail server in a dedicated network segment with strict firewall rules
- Implement application-level firewall or WAF with buffer overflow protection rules
🔍 How to Verify
Check if Vulnerable:
Check the Active! mail version in the application interface or installation directory. Versions 6.60.05008561 and earlier are vulnerable.Check Version:
Check the application interface or examine the installation directory for version information files.Verify Fix Applied:
Verify the version is 6.60.05008562 or later and test mail functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Unusual connection patterns to mail ports
- Large or malformed requests to mail service
- Service crashes or restarts
Network Indicators:
- Unusual traffic patterns to mail server ports (25, 110, 143, 587, 993, 995)
- Large payloads sent to mail service
SIEM Query:
source="mail_server" AND (event_type="crash" OR bytes_received>10000) OR (src_ip NOT IN trusted_networks AND dest_port IN (25,110,143,587,993,995))