Actively exploited in the wild
OpenSMTPD Remote Code Execution Vulnerability
OpenBSD - OpenSMTPD · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-7247
CriticalCVSS 9.8KEVSummary
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Risk Assessment
An attacker can remotely execute arbitrary commands as root, taking full control of the mail server and system.
Recommendation
Update OpenSMTPD to version 6.6.1 or later, which fixes this vulnerability.
Other vulnerabilities in OpenSMTPD
See all- CVE-2015-7687Critical
A use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.
- CVE-2025-62875Medium
An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.
Original NVD description (English source)
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS