CVE-2019-7214

EPSS 84.8%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Popular PoC on GitHub (4 stars) — exploitation code widely available.

CVSS —EPSS 84.8%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

17 Apr 2019Metasploit module available

24 Apr 2019Published on NVD

09 Dec 2020Public PoC

Weaponization speed

595 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

Affected products

n/a · n/a

public PoCs found — 7

githubgithub.com/Drew-Alleman/CVE-2019-7214★ 4 githubgithub.com/devzspy/CVE-2019-7214★ 2 githubgithub.com/andyfeili/-CVE-2019-7214★ 1 githubgithub.com/ElusiveHacker/CVE-2019-7214★ 0 cve_referencepacketstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.htmlunverified cve_referencepacketstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/49216unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/https://www.smartertools.com/smartermail/release-notes/current