CVE-2023-34207

CRITICAL

EasyUse MailHunter Ultimate < 2023 - Authenticated Arbitrary Command Execution via Crafted ZIP Archive

Title source: llm

Description

Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT Authority\SYSTEM‘ privilege via a crafted ZIP archive.

References (1)

Core 1

Core References

Third Party Advisory third-party-advisory

https://zuso.ai/Advisory/ZA-2023-04

Scores

CVSS v3 9.9

EPSS 0.0065

EPSS Percentile 46.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

easyuse/mailhunter_ultimate < 2023

Published Oct 17, 2023

Tracked Since Feb 18, 2026