CVE-2023-42117

CRITICAL LAB

Exim < 4.96.2 - Unauthenticated Remote Code Execution via SMTP Service

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-42117. PoCs published by exploitintel.

AI-analyzed exploit summary This repository contains functional exploit code for CVE-2023-42117, a critical vulnerability in Exim MTA's IP address parser. The PoC scripts demonstrate multiple attack vectors (leading signs, leading zeros, malformed IPv6, whitespace) that bypass validation and crash the Exim child process, resulting in a pre-authentication DoS.

Description

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17554.

Exploits (1)

github WORKING POC 1 stars
by exploitintel · pythonpoc
https://github.com/exploitintel/eip-pocs-and-cves/tree/main/CVE-2023-42117

This repository contains functional exploit code for CVE-2023-42117, a critical vulnerability in Exim MTA's IP address parser. The PoC scripts demonstrate multiple attack vectors (leading signs, leading zeros, malformed IPv6, whitespace) that bypass validation and crash the Exim child process, resulting in a pre-authentication DoS.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Exim Mail Transfer Agent < 4.96.2 (with SUPPORT_PROXY=yes)
No auth needed
Prerequisites: Exim compiled with SUPPORT_PROXY=yes · Exim configured with hosts_proxy matching attacker's source IP
devstral-2 · analyzed Mar 04, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0567
EPSS Percentile 92.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Lab Environment

EIP LAB
Docker Lab
vulnerable docker pull ghcr.io/exploitintel/cve-2023-42117-vulnerable:latest

Details

CWE
CWE-138
Status published
Products (1)
exim/exim < 4.96.2
Published May 03, 2024
Tracked Since Feb 18, 2026