CVE-2025-15610

CriticalCVSS 9.3/10Last modified Oct 7, 2026

Description

The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploited if the service is exposed in environments where the remoting ports are accessible.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
OpenText, Inc	RightFax	>= 16.6, <= 16.6 Update7136; >= 20.2, <= 20.2 Update5705; >= 21.2, <= 21.2.1.2707; >= 22.2, <= 22.2.0.1644; >= 23.4, <= 26.4.0.1644; >= 24.4, <= 24.4.0.1644; >= 25.4, <= 25.4.0.1644

References

https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0861863

Timeline

Published: Apr 15, 2026
Last modified: Oct 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-156115.4The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup da CVE-2025-156128.1Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, di CVE-2025-156136.5Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission t CVE-2025-156143.3ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attacker CVE-2025-156157.5Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS ren CVE-2025-156167.2Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities t CVE-2025-156178.1Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOK CVE-2025-156189.1Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key. Business::OnlinePayment::StoredTrans CVE-2025-156193.5HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenari CVE-2025-15629.8The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable CVE-2025-156208.6HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web inter CVE-2025-156216.0Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 cre