CVE-2025-58107 Details
Description
In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password.
A vulnerability in Microsoft Exchange ActiveSync (EAS) configurations on on-premises servers through 2019 allows for the transmission of sensitive data from Samsung mobile devices in cleartext. This includes the user's name, email address, device ID, bearer token, and base64-encoded password. The issue arises from the continued use of Basic Authentication, which was officially deprecated on October 1, 2022, yet remains active and exposes credentials and tokens to interception.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://geochen.medium.com/microsoft-activesync-legacy-protocol-plaintext-credential-and-token-exposure-vulnerability-b0fad89014fa | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-319 | Cleartext Transmission of Sensitive Information | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 2, 2026 | CVE Modified | CISA-ADP |
| Mar 2, 2026 | New CVE Received | [email protected] |