CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
Published Jan 29, 2020 · updated Jun 16, 2026 · openbsd opensmtpd
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Timeline
Detection, updates, and resolution for this record.
Jan 29, 2020 · Catalog
Detected
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe canonical/ubuntu linux18.04
- cpe canonical/ubuntu linux19.10
- cpe debian/debian linux10.0
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora32
- cpe openbsd/opensmtpd6.6
- vendor OpenBSD OpenSMTPDversion unspecified
Sources
- CISA KEVCVE-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
cisa.gov - CVE.orgCVE-2020-7247
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-7247
30-day exploitation probability 99.0%
first.org - Exploit Database47984
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database48038
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database48051
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_unix/smtp/opensmtpd_mail_from_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" defa
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com