CVE-2021-20617

CRITICAL EXPLOITED NUCLEI

acmailer <4.0.1 - Command Injection

Title source: llm

Description

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified vectors.

Nuclei Templates (1)

Acmailer - Improper Access Control to OS Command Injection

CRITICALVERIFIEDby daffainfo

Shodan: title="ACMAILER4.0"

FOFA: title="ACMAILER4.0"

References (2)

[Third Party Advisory] https://jvn.jp/en/jp/JVN35906450/index.html

[Vendor Advisory] https://www.acmailer.jp/info/de.cgi?id=101

Scores

CVSS v3 9.8

EPSS 0.5238

EPSS Percentile 97.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2024-12-05

Status published

Products (2)

acmailer/acmailer < 4.0.1

acmailer/acmailer_db < 1.1.3

Published Jan 14, 2021

Tracked Since Feb 18, 2026