CVE-2025-68722
📋 TL;DR
This CSRF vulnerability in Axigen Mail Server's WebAdmin interface allows attackers to craft malicious URLs that execute administrative actions when clicked by authenticated administrators. The vulnerability automatically processes base64-encoded commands in the _s parameter via GET requests immediately after login. All administrators using vulnerable versions are affected.
💻 Affected Systems
- Axigen Mail Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through creation of rogue administrator accounts, modification of critical configurations, or service disruption.
Likely Case
Unauthorized administrative account creation leading to persistent access and potential data exfiltration.
If Mitigated
Limited impact if administrators use separate browser profiles for administrative tasks and avoid clicking untrusted links.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators into clicking malicious links but has low technical complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.5.57 or 10.6.26
Vendor Advisory: https://www.axigen.com/knowledgebase/Axigen-WebAdmin-CSRF-Vulnerability-CVE-2025-68722-_407.html
Restart Required: Yes
Instructions:
1. Download latest version from Axigen website. 2. Backup current configuration. 3. Install update following vendor instructions. 4. Restart Axigen services.
🔧 Temporary Workarounds
Use POST-only administrative interface
allConfigure WebAdmin to reject state-changing GET requests
Browser isolation for administrative tasks
allUse separate browser profiles or dedicated machines for administrative access
🧯 If You Can't Patch
- Implement strict access controls limiting WebAdmin access to specific IP addresses
- Educate administrators to never click links while authenticated to WebAdmin
🔍 How to Verify
Check if Vulnerable:
Check Axigen version via WebAdmin interface or command line: axigen --versionCheck Version:
axigen --versionVerify Fix Applied:
Verify version is 10.5.57 or higher, or 10.6.26 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual administrative actions from unexpected IP addresses
- Multiple administrator account creations in short timeframes
Network Indicators:
- GET requests to WebAdmin with base64-encoded _s parameter
- Administrative actions without corresponding POST requests
SIEM Query:
source="axigen" AND (url="*_s=*" OR action="create_admin" OR action="modify_config")