CVE-2025-58107

high Microsoft
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: March 2, 2026
Last Modified: March 2, 2026
Vendor: Microsoft

Description

In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password.

CWE

CWE-319

References

🔗 geochen.medium.com