U/OO/140757-20 PP-20-0393 28 May 2020
media.defense.gov · Undated · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2019-10149Exim Mail Transfer Agent (MTA) Improper Input ValidationExim · Mail Transfer Agent (MTA)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter3 reports>99.9%Top 0.02%77.6priority
Where it names them
CVE-2019-10149 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
On 5 June 2019, an update for a critical vulnerability (CVE-2019-10149) in Exim was released.
When CVE-2019-10149 is successfully exploited, an actor is able to execute code of their choosing.
exploited CVE-2019-10149, the victim machine would subsequently download and execute a shell script from a
Additionally, network-based security appliances may be able to detect and/or block CVE-2019-10149 exploit attempts.
can also be queried for emails with a recipient containing “${run”, which would likely indicate a CVE -2019-10149 exploit
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.