{"id":"CVE-2020-7247","published":"2020-01-29T16:15:12Z","modified":"2026-06-17T03:24:35Z","title":"OpenSMTPD Remote Code Execution Vulnerability","vendor":"OpenBSD","product":"OpenSMTPD","tier":"core","eol":null,"description":{"text":"smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","provenance":"source","from":"NVD"},"summary":{"text":"The OpenSMTPD mail server, specifically the smtp_mailaddr routine in smtp_session.c as shipped in OpenSMTPD 6.6 and OpenBSD 6.6, fails to properly reject invalid input in MAIL FROM addresses because it returns an incorrect value when validation fails. An unauthenticated remote attacker who can reach the SMTP service of a default (uncommented) configuration can send a crafted SMTP session containing shell metacharacters to run arbitrary commands as root, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:07Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98972,"percentile":0.99929,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-7247","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-25","exploitedFirstSeen":"2022-03-25","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-755","name":"Improper Handling of Exceptional Conditions"}],"references":[{"url":"http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.html","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2020/Jan/49","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/01/28/3","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dcb45","tags":["Patch"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2020/Jan/51","tags":["Mailing List","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4268-1/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4611","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/390745","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.openbsd.org/security.html","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.html","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2020/Jan/49","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/01/28/3","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dcb45","tags":["Patch"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2020/Jan/51","tags":["Mailing List","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4268-1/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4611","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/390745","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.openbsd.org/security.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7247","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote SMTP session exploits public-facing mail service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary commands as root via a crafted SMTP session","start":93,"end":181}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary command execution via shell metacharacters","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary commands as root via a crafted SMTP session","start":120,"end":181}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-28374","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28374","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":47984,"url":"https://www.exploit-db.com/exploits/47984","title":"OpenSMTPD 6.6.1 - Remote Code Execution","type":"remote","platform":"linux","date":"2020-01-30","verified":true,"provenance":"source"},{"id":48038,"url":"https://www.exploit-db.com/exploits/48038","title":"OpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)","type":"remote","platform":"linux","date":"2020-02-10","verified":true,"provenance":"source"},{"id":48051,"url":"https://www.exploit-db.com/exploits/48051","title":"OpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution","type":"remote","platform":"openbsd","date":"2020-02-11","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2020-01-30"},"pocGithub":{"count":9,"skipped":2,"earliest":"2020-01-30","earliestUrl":"https://github.com/FiroSolutions/cve-2020-7247-exploit","repos":[{"name":"FiroSolutions/cve-2020-7247-exploit","url":"https://github.com/FiroSolutions/cve-2020-7247-exploit","stars":25,"created":"2020-01-30"},{"name":"QTranspose/CVE-2020-7247-exploit","url":"https://github.com/QTranspose/CVE-2020-7247-exploit","stars":11,"created":"2021-02-13"},{"name":"r0lh/CVE-2020-7247","url":"https://github.com/r0lh/CVE-2020-7247","stars":5,"created":"2020-02-18"},{"name":"superzerosec/cve-2020-7247","url":"https://github.com/superzerosec/cve-2020-7247","stars":4,"created":"2020-02-17"},{"name":"f4T1H21/CVE-2020-7247","url":"https://github.com/f4T1H21/CVE-2020-7247","stars":2,"created":"2021-06-19"}]},"metasploit":[{"name":"OpenSMTPD MAIL FROM Remote Code Execution","module":"exploit/unix/smtp/opensmtpd_mail_from_rce","type":"exploit","disclosureDate":"2020-01-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/smtp/opensmtpd_mail_from_rce.rb"}],"nuclei":[{"id":"CVE-2020-7247","name":"OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution","severity":"critical","path":"javascript/cves/2020/CVE-2020-7247.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-7247.yaml"}],"first":{"date":"2020-01-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/smtp/opensmtpd_mail_from_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html","http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html","http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html","http://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.html","http://seclists.org/fulldisclosure/2020/Jan/49","http://www.openwall.com/lists/oss-security/2020/01/28/3","http://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-01-28","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2020-01-30, PoC-in-GitHub 2020-01-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/smtp/opensmtpd_mail_from_rce.rb","provenance":"source"},{"date":"2020-01-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7247","provenance":"source"},{"date":"2022-03-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28374","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":786},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1680 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 NVD references tagged Exploit; 3 Exploit-DB entries; 1 NVD exploit link; 9 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}