Sploitus

CVE-2020-7247

36 known exploits for CVE-2020-7247

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Affected products
Opensmtpd, Ubuntu
Openbsd Opensmtpd
= 6.6
Fix
Available
CVSS 2.0
10.0 HIGH
CVSS 3.1
9.8 CRITICAL
EPSS
99.0% (100th percentile)
Weakness
CWE-755, CWE-78
NVD status
Analyzed
Published
2020-01-29
CVE-2020-7247 at NVD
Authoritative description, scoring and affected products

36 known exploits for CVE-2020-7247

Proof-of-concept code and exploit modules indexed by Sploitus

cve-2020-7247
2026-08-26 KitPloitKITPLOIT
OpenSMTPD-CVE-2020-7247-
2026-08-26 KitPloitKITPLOIT
CVE-2020-7247
2026-08-26 KitPloitKITPLOIT
cve-2020-7247-exploit
2026-08-26 KitPloitKITPLOIT
local-exploits
2026-08-26 KitPloitKITPLOIT
CVE-2020-7247-reproducer
2026-08-26 KitPloitKITPLOIT
CVE-2020-7247
2026-08-25 KitPloitKITPLOIT
CVE-2020-7247-exploit
2026-08-25 KitPloitKITPLOIT
CVE-2020-7247
2026-08-25 KitPloitKITPLOIT
CVE-2020-7247-POC
2026-08-24 KitPloitKITPLOIT
Exploit for OS Command Injection in Openbsd Opensmtpd
2026-06-28 solmin111GITHUB
Exploit for CVE-2002-0526
2026-03-12 buildcoveGITHUB
Exploit for Improper Handling of Exceptional Conditions in Openbsd Opensmtpd
2021-06-19 f4T1H21GITHUB
OpenBSD OpenSMTPD 6.6 Remote Code Execution Exploit
2021-04-07 Tobias MarcottoZDTPython
OpenBSD OpenSMTPD 6.6 Remote Code Execution
2021-04-06 Tobias MarcottoPACKETSTORMPython
Exploit for Improper Handling of Exceptional Conditions in Openbsd Opensmtpd
2021-02-13 QTransposeGITHUB
Exploit for Improper Handling of Exceptional Conditions in Openbsd Opensmtpd
2020-02-18 r0lhGITHUB
Exploit for Improper Handling of Exceptional Conditions in Openbsd Opensmtpd
2020-02-17 superzerosecGITHUB
OpenSMTPD 6.6.1 - Local Privilege Escalation Exploit
2020-02-11 Marco IvaldiZDT
OpenSMTPD 6.4.0 6.6.1 - Local Privilege Escalation + Remote Code Execution
2020-02-11 Marco IvaldiEXPLOITPACK
OpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution
2020-02-11 Marco IvaldiEXPLOITDB
OpenSMTPD 6.6.1 Local Privilege Escalation
2020-02-11 Marco IvaldiPACKETSTORM
OpenSMTPD - MAIL FROM Remote Code Execution Exploit
2020-02-10 metasploitZDTRuby
OpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)
2020-02-10 MetasploitEXPLOITDBRuby
OpenSMTPD MAIL FROM command injection
2020-02-10 SAINT CorporationSAINT
OpenSMTPD MAIL FROM command injection
2020-02-10 SAINT CorporationSAINT
OpenSMTPD MAIL FROM command injection
2020-02-10 SAINT CorporationSAINT
OpenSMTPD MAIL FROM Remote Code Execution
2020-02-07 wvuPACKETSTORMRuby
OpenSMTPD 6.6.2 - Remote Code Execution Exploit
2020-01-30 1F98DZDTPython
OpenSMTPD 6.6.2 - Remote Code Execution
2020-01-30 1F98DEXPLOITPACKPython
OpenSMTPD 6.6.1 - Remote Code Execution
2020-01-30 1F98DEXPLOITDBPython
OpenSMTPD 6.6.2 Remote Code Execution
2020-01-30 Qualys Security AdvisoryPACKETSTORMPython
Exploit for Improper Handling of Exceptional Conditions in Openbsd Opensmtpd
2020-01-30 FiroSolutionsGITHUB
OpenBSD OpenSMTPD Privilege Escalation / Code Execution Vulnerabilities
2020-01-29 Qualys Security AdvisoryZDT
OpenBSD OpenSMTPD Privilege Escalation / Code Execution
2020-01-29 Qualys Security AdvisoryPACKETSTORM
OpenSMTPD MAIL FROM Remote Code Execution
2020-01-28 Qualys, wvu <wvu@metasploit.com>, RageLtMan <rageltman@sempervictus>METASPLOITRuby