CVE-2025-10095 SQL injection in SMPP component of SMSEagle firmware
SQL injection in SMSEagle firmware allows attackers to manipulate the SMPP server database via unsanitized input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10095?
CVE-2025-10095 is a medium-severity SQL injection vulnerability in Proximus sp. z o.o. SMSEagle, published on 9 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A SQL injection vulnerability has been identified in the SMPP server component of the SMSEagle firmware, specifically affecting the handling of certain parameters within the server's database interactions. The vulnerability is isolated to the SMPP server, which operates with its own dedicated database, separate from the main software's database. This isolation limits the scope of the vulnerability to the SMPP server's operations. The vulnerability arises from improper sanitization of user input in the SMPP server's scripts.
This issue has been fixed in version 6.11.
Weakness: CWE-89
Which versions are affected by CVE-2025-10095?
How do I fix CVE-2025-10095?
No fix has been published for CVE-2025-10095 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-10095 being exploited?
There is no known exploitation of CVE-2025-10095 in the wild and no public exploit code.
Sources
Also known as GHSA-p2rh-v47g-x486.