peter bassill · operator
$ cve CVE-2020-7247 JSON

CVE-2020-7247 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 99% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-15.

Description

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS98.97% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2022-04-15
Public exploityes
Published2020-01-29
Last modified2026-06-17

CISA KEV

NameOpenSMTPD Remote Code Execution Vulnerability
Added2022-03-25
Due2022-04-15
Vendor / productOpenBSD / OpenSMTPD
Ransomware usenone reported

Affected (4)

VendorProduct
canonicalubuntu linux
debiandebian linux
fedoraprojectfedora
openbsdopensmtpd

Public exploits

SourceTitleDate
exploit-dbOpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution2020-02-11
exploit-dbOpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)2020-02-10
exploit-dbOpenSMTPD 6.6.1 - Remote Code Execution2020-01-30

References

→ the Explorer  ·  watch your stack  ·  NVD