## https://sploitus.com/exploit?id=F0040A1C-C568-5880-B2F8-FDF3EF77E3A9
# CVE-2026-73570 PoC - SMTP Command Injection Tester
A custom, low-level Python proof-of-concept (PoC) script for testing SMTP command injection vulnerabilities (CVE-2026-73570).
This tool sends a malformed `RCPT TO` address containing shell-style command substitution (e.g., `$(command)`) to determine if the target mail server or its downstream processing pipeline improperly passes the address through a shell without sanitization.
> **⚠️ DISCLAIMER:** This tool is intended for educational purposes and authorized security testing ONLY. Ensure you have explicit permission to test the target infrastructure. Unauthorized scanning or exploitation of mail servers is illegal.
## Repository
**GitHub:** [https://github.com/byt3l0rd/CVE-2026-73570](https://github.com/byt3l0rd/CVE-2026-73570)
**Author:** byt3l0rd0day
## Bug Info (Targeting Zimbra)
Not every Zimbra box is vulnerable. All of these conditions must be true:
1. The optional `zimbra-snmp` package is installed (often prompted at installation).
2. SNMP trap notifications are enabled (`snmp_notify`).
3. The `swatchdog` service is running (on by default).
**Attack Surface:** The attack does **not** need SNMP (UDP/161/162) exposed to the attacker. The malicious input arrives over standard SMTP.
### The Root Cause
The `swatchdog` process tails `/var/log/zimbra.log` using configuration from `/opt/zimbra/conf/swatchrc.in`. It actively matches log entries using the following regular expressions:
```regex
/: Service status change: (\S+) (.*) changed from stopped to running/
/: Service status change: (\S+) (.*) changed from running to stopped/