CVE-2019-7214
CRITICALSmarterTools SmarterMail less than build 6985 - .NET Deserialization Remote Code Execution
Title source: metasploitDescription
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.
Exploits (6)
metasploit
WORKING POC
EXCELLENT
by Soroush Dalili, 1F98D, Ismail E. Dawoodjee · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/smartermail_rce.rb
References (4)
Scores
CVSS v3
9.8
EPSS
0.8293
EPSS Percentile
99.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
Status
published
Affected Products (1)
smartertools/smartermail
< 16.3.6985
Timeline
Published
Apr 24, 2019
Tracked Since
Feb 18, 2026