SmarterTools SmarterMail versions before Build 9610 employ DES‑CBC encryption for file and email sharing. The encryption keys and IVs are derived from keys produced by System.Random seeded with minimal entropy, limiting the key space to roughly 19,000 possibilities. This weakness allows an attacker to reconstruct the encryption parameters. By probing the attachment download endpoint, an unauthenticated user can determine the seed and then forge sharing tokens that grant access to any email, attachment, or file stored by the system. The vulnerability is a cryptographic weakness due to weak random number generation (CWE‑338) and results in compromised confidentiality and integrity of user content.

SmarterTools Inc. SmarterMail, all builds prior to 9610. The affected versions include any installation using DES‑CBC‑based sharing endpoints before the release of Build 9610.

The CVSS score of 8.2 indicates a high severity, and the lack of an EPSS score means we cannot estimate current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can exploit the weakness by sending crafted requests to the sharing download endpoint, using the oracle to recover the seed and subsequently generating valid tokens for arbitrary content. Because the vulnerability is tied to built‑in encryption logic, exploitation requires only network access to the vulnerable SmarterMail instance; no privileged credentials are needed.