Vulnerability · Published Jul 29, 2024 · Assigned by twcert
CVE-2024-5670Softnext Mail SQR Expert and Mail Archiving Expert - OS Command Injection
Critical 9.8
In plain English
A critical-severity OS command injection in SN OS 10.3 from Softnext. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 40.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Softnext | SN OS 12.1 | 0 – before 230922 |
| Softnext | SN OS 12.3 | 0 – before 230922 |
| Softnext | SN OS 10.3 | 0 – before 230631 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-7958-817f4-1.html vendor-advisory
- https://www.twcert.org.tw/en/cp-139-7959-09d0e-2.html vendor-advisory