CVE DatabaseCVE-2020-7247

Updated 2026-06-17한국어 권고문 →

CVE-2020-72479.8/CRITICALCISA KEVCWE-78CWE-755CWE-755

OpenSMTPD Remote Code Execution and Privilege Escalation Vulnerability Analysis (CVE-2020-7247)

⚡ Jump to Patch

Affected Vendors

openbsd, opensmtpd

Affected Components

opensmtpd

Published Date

2020-01-29

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

OpenSMTPD version 6.6 running with the default 'uncommented' configuration on OpenBSD 6.6 and other platforms.

Impact

Unauthenticated remote attackers can execute arbitrary system commands with root privileges by injecting shell metacharacters into the MAIL FROM field of an SMTP session.

Mitigation

Immediately upgrade OpenSMTPD to the patched version 6.6.1p1, 6.6.2p1, or later.

Affected Products & Version Scope

OpenSMTPD version 6.6 (default configuration on OpenBSD 6.6 and other distributions)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Update OpenSMTPD to the latest patched version (6.6.2p1 or later) using your system package manager.

bash

# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade opensmtpd -y

# For OpenBSD systems
syspatch

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to the SMTP port (TCP 25) using firewall rules to allow only trusted IP addresses.

bash

# Restrict SMTP access using iptables
sudo iptables -A INPUT -p tcp --dport 25 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 25 -j DROP

3. Log Audit & IoC Verification Commands

Inspect mail logs for suspicious SMTP sessions containing shell metacharacters in the sender address field.

bash

# Search for shell metacharacters in MAIL FROM logs
grep -Ei 'mail from:.*[;|`\$]' /var/log/maillog /var/log/mail.log 2>/dev/null

# Verify the installed OpenSMTPD version
smtpd -V

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Apply the official security patches immediately and restrict external SMTP access to mitigate the risk of remote root compromise.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability exists in the smtp_mailaddr function within smtp_session.c of OpenSMTPD. The root cause is an incorrect return value handling logic when input validation fails (CWE-755). Instead of rejecting the invalid address and terminating the session, the application proceeds with processing, effectively bypassing the input validation mechanism.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates an SMTP session and sends a crafted MAIL FROM command containing shell metacharacters (such as semicolons or backticks). Because the validation failure is ignored, the unsanitized string is passed directly to the system shell when OpenSMTPD executes local delivery mechanisms. This leads to OS Command Injection (CWE-78), allowing arbitrary command execution without authentication.

3. Infrastructure & Business Impact

Since OpenSMTPD processes run with elevated privileges to handle mail delivery, successful exploitation grants the attacker full root access to the underlying operating system. This can lead to complete system compromise, unauthorized access to sensitive email data, and lateral movement within the enterprise network.

Official Vendor Advisories & References

NVD Original English Description

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.html

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

http://seclists.org/fulldisclosure/2020/Jan/49

Source: cve@mitre.org · Exploit, Mailing List, Third Party Advisory

Frequently Asked SecOps Questions (CVE-2020-7247)

FAQ

Q1. How critical is CVE-2020-7247 and is it actively exploited in the wild?

CVE-2020-7247 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-7247?

Primary impacted vendors include openbsd, opensmtpd across opensmtpd. Scope summary: OpenSMTPD version 6.6 (default configuration on OpenBSD 6.6 and other distributions)

Q3. What temporary mitigations or workarounds exist for CVE-2020-7247 before patching?

[Mitigation] Immediately upgrade OpenSMTPD to the patched version 6.6.1p1, 6.6.2p1, or later. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION