CVE-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products,...
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- Record
CVE-2020-7247- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-78, CWE-755
- Updated
- 2026-11-02
CVE List
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- Record
CVE-2020-7247- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-755
- Updated
- 2026-11-02
EUVDEUVD-2020-28374
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- Record
EUVD-2020-28374- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rcw6-69h3-89fh
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products,...
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- Record
GHSA-rcw6-69h3-89fh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78, CWE-252, CWE-755
- Updated
- 2026-11-02
CISA KEV No score
OpenSMTPD Remote Code Execution Vulnerability
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
- Record
CVE-2020-7247- Weakness
- CWE-755, CWE-78
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- Record
ALPINE-CVE-2020-7247- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSV
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- Record
CVE-2020-7247- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- Record
DEBIAN-CVE-2020-7247- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- Record
UBUNTU-CVE-2020-7247- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-4268-1 No score
OpenSMTPD vulnerability
It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could use this vulnerability to execute arbitrary commands as root.
- Record
USN-4268-1- Updated
- 2026-11-02
OSVUSN-4875-1 No score
opensmtpd vulnerabilities
It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could possibly use this vulnerability to execute arbitrary commands as root. (CVE-2020-7247)
It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An unprivileged local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-8793)
It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could possibly use this vulnerability to execute arbitrary shell commands as any non-root user. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-8794)
- Record
USN-4875-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensmtpdAlpine:v3.11 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.12 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.13 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.14 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.15 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.16 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.17 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.18 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.19 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.20 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensmtpdAlpine:v3.21 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.22 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.23 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdAlpine:v3.24 |
before 6.6.2p1-r0 | 6.6.2p1-r0 |
opensmtpdDebian:12 |
before 6.6.2p1-1 | 6.6.2p1-1 |
opensmtpdDebian:13 |
before 6.6.2p1-1 | 6.6.2p1-1 |
opensmtpdDebian:14 |
before 6.6.2p1-1 | 6.6.2p1-1 |
opensmtpdDebian:9 |
before 6.0.2p1-2+deb9u2, plus listed versions 6.0.2p1-26.0.2p1-2+deb9u1 |
6.0.2p1-2+deb9u2 |
opensmtpdDebian:10 |
before 6.0.3p1-5+deb10u3, plus listed versions 6.0.3p1-56.0.3p1-5+deb10u16.0.3p1-5+deb10u2 |
6.0.3p1-5+deb10u3 |
opensmtpdUbuntu:Pro:14.04:LTS |
before 5.4.1p1-1ubuntu0.1~esm1, plus listed versions 5.3.3p1-45.4.1p1-1 |
5.4.1p1-1ubuntu0.1~esm1 |
opensmtpdUbuntu:Pro:16.04:LTS |
before 5.7.3p2-1ubuntu0.1~esm1, plus listed versions 5.4.2p1-45.7.3p1-15.7.3p2-1 |
5.7.3p2-1ubuntu0.1~esm1 |
opensmtpdUbuntu:18.04:LTS |
before 6.0.3p1-1ubuntu0.1, plus listed versions 6.0.2p1-2build16.0.3p1-16.0.3p1-1build1 |
6.0.3p1-1ubuntu0.1 |
opensmtpdUbuntu:Pro:16.04:LTS |
before 5.7.3p2-1ubuntu0.1~esm2, plus listed versions 5.4.2p1-45.7.3p1-15.7.3p2-15.7.3p2-1ubuntu0.1~esm1 |
5.7.3p2-1ubuntu0.1~esm2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | OpenSMTPD MAIL FROM Remote Code Execution | 2020-01-28 |
| Exploit-DB | OpenSMTPD 6.6.1 - Remote Code Execution | 2020-01-30 |
| PoC in GitHub | FiroSolutions/cve-2020-7247-exploit | 2020-01-30 |
| Exploit-DB | OpenSMTPD - MAIL FROM Remote Code Execution (Metasploit) | 2020-02-10 |
| Exploit-DB | OpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution | 2020-02-11 |
| PoC in GitHub | superzerosec/cve-2020-7247 | 2020-02-17 |
| PoC in GitHub | r0lh/CVE-2020-7247 | 2020-02-18 |
| PoC in GitHub | QTranspose/CVE-2020-7247-exploit | 2021-02-13 |
| PoC in GitHub | bytescrappers/CVE-2020-7247 | 2021-06-02 |
| PoC in GitHub | f4T1H21/CVE-2020-7247 | 2021-06-19 |
Show 6 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | SimonSchoeni/CVE-2020-7247-POC | 2021-11-26 |
| PoC in GitHub | presentdaypresenttime/shai_hulud | 2022-02-07 |
| PoC in GitHub | minhluannguyen/CVE-2020-7247-reproducer | 2025-03-20 |
| PoC in GitHub | solmin111/OpenSMTPD-CVE-2020-7247- | 2026-06-28 |
| PoC in GitHub | CyberCTF/vulhub-opensmtpd-cve-2020-7247 | 2026-10-08 |
| Nuclei | OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| affected, exploits | OSV | |
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7247 is a critical vulnerability (CVSS 9.8) in Openbsd Opensmtpd, published January 29, 2020. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.0%, the 99th percentile. Fixed in opensmtpd 6.6.2p1-r0.
References
openbsd.org/security.html
openwall.com/lists/oss-security/2020/01/28/3
github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dcb45
packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html
seclists.org/bugtraq/2020/Jan/51
debian.org/security/2020/dsa-4611
Show 23 moreShow less
kb.cert.org/vuls/id/390745
usn.ubuntu.com/4268-1
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7247
nvd.nist.gov/vuln/detail/CVE-2020-7247
security.alpinelinux.org/vuln/CVE-2020-7247
security-tracker.debian.org/tracker/CVE-2020-7247
ubuntu.com/security/CVE-2020-7247
ftp.openbsd.org/pub/OpenBSD/patches/6.6/common/019_smtpd_exec.patch.sig
cve.org/CVERecord?id=CVE-2020-7247