4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-987x-96fq-9384

GHSA-987x-96fq-9384: Duplicate Advisory: Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gwq6-fmvp-qp68. This link is maintained to preserve external references.

Original Description

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-987x-96fq-9384

GHSA-987x-96fq-9384:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Microsoft.NetCore.App.Runtime.linux-arm	nuget	>= 9.0.0, < 9.0.10	9.0.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2025-55248, allows a man-in-the-middle attacker to downgrade a TLS connection to plaintext during SMTP communication in .NET applications using SmtpClient. By analyzing the commits between the vulnerable versions (v9.0.9, v8.0.20) and the patched versions (v9.0.10, v8.0.21) of the dotnet/runtime repository, I identified the exact code change that mitigates this vulnerability. The fix is located in the SendHello method within the System.Net.Mail.SmtpConnection class. Before the patch, if a server did not respond to the EHLO command (which is required to negotiate TLS via STARTTLS), the client would insecurely fall back to the older HELO command, even if EnableSsl was set to true. This would cause credentials and email data to be sent unencrypted. The patch, introduced in commits like 18e28d767acf44208afa6c4e2e67a10c65e9647e and 44527b9ed8427463578126a4494c3654dda11866, adds a check at the beginning of SendHello. This check throws an exception if EnableSsl is true, thus preventing the insecure downgrade and ensuring the connection is terminated if a secure channel cannot be established. Therefore, the System.Net.Mail.SmtpConnection.SendHello function is the direct location of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.