Log in Start free

Actively exploited · Published Jan 29, 2020 · Assigned by mitre

CVE-2020-7247

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in OpenSMTPD from OpenBSD. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 99.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)99.0%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20opensmtpd6.6.2p1-r0ALPINE-CVE-2020-7247
Alpine:v3.21opensmtpd6.6.2p1-r0ALPINE-CVE-2020-7247
Alpine:v3.22opensmtpd6.6.2p1-r0ALPINE-CVE-2020-7247
Alpine:v3.23opensmtpd6.6.2p1-r0ALPINE-CVE-2020-7247
Alpine:v3.24opensmtpd6.6.2p1-r0ALPINE-CVE-2020-7247
Debian:12opensmtpd6.6.2p1-1DEBIAN-CVE-2020-7247
Debian:13opensmtpd6.6.2p1-1DEBIAN-CVE-2020-7247
Debian:14opensmtpd6.6.2p1-1DEBIAN-CVE-2020-7247

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References