Description

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-06T14:17:46.417Z",
  "pubdate": "2026-10-06T14:17:46.417Z",
  "executiveSummary": "Expert Mail is susceptible to a vulnerability categorized as Improper Control of Interaction Frequency, allowing for unauthorized authentication attempts through brute force attacks.\nThis vulnerability stems from the absence of sufficient rate-limiting mechanisms on authentication endpoints, enabling an adversary to automate repetitive login requests against user accounts.\nThe primary risk associated with this flaw is unauthorized access to sensitive communications, potential account takeover, and data exfiltration.\nSuccessful exploitation requires no prior authentication and can be performed remotely over a network by leveraging automated tools to cycle through password dictionaries or credential lists.\nThe vulnerability affects all versions of Expert Mail through 2026-09-18, posing a significant security risk for organizations relying on this platform for secure mail communication.",
  "technicalDetails": "The vulnerability is identified as an Improper Control of Interaction Frequency (CWE-799), which manifests in the authentication handler of the Expert Mail platform.\nThe root cause of this flaw is the lack of a robust, stateful rate-limiting or throttling mechanism on the login or authentication API endpoints. Without effective mechanisms to track and limit the number of failed login attempts originating from a specific IP address or targeting a single user account, the application remains vulnerable to dictionary attacks and credential stuffing.\nThe attack flow begins with an adversary identifying the authentication interface of the Expert Mail application. Utilizing automated scripts or specialized brute-forcing tools, the attacker initiates a high volume of login requests, rapidly iterating through common password combinations or previously leaked credentials.\nBecause the system does not enforce delays between failed attempts or implement progressive lockout policies, the attacker can perform thousands of login attempts in a short timeframe without being blocked by the application's security controls.\nThe vulnerable component resides within the authentication logic layer, which fails to track session attempts relative to time-based windows or originating network identifiers. As this process does not require elevated privileges or pre-existing authentication tokens, it is classified as an unauthenticated attack vector.\nThe post-exploitation impact includes the successful compromise of legitimate user credentials, granting the attacker unauthorized entry into the victim's email account. Upon gaining access, the attacker may perform unauthorized actions, including the inspection of private communications, modification of email configurations, or redirection of messages to external servers for further data harvesting. In environments where email serves as a primary vector for identity verification, this breach may lead to secondary compromises of third-party services linked to the email account.\nThis vulnerability is persistent across all versions of the product up to the identified date, as the underlying architecture fails to differentiate between legitimate user interactions and high-frequency automated polling characteristic of brute force attacks."
}