A critical zero-day vulnerability, tracked as CVE-2023-42115 (CVSS score 9.8), affects all versions of Exim mail transfer agent (MTA) software. A remote, unauthenticated attacker, can exploit the vulnerability to gain remote code execution (RCE) on Internet-exposed servers.
The flaw is due to an Out-of-bounds Write issue that resides in the SMTP service, it is caused by the lack of proper validation of user-supplied data.
“This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.” reads the advisory published by Trend Micro’s Zero Day Initiative (ZDI). “The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.”
An anonymous researcher disclosed the flaw through the ZDI on June 6, 2022, and ZDI reported the vulnerability to the vendor on June 14, 2022.
On September 25, 2023, ZDI asked for an update and informed the vendor that they intend to publicly disclose the zero-day on September 27, 2023.
The vulnerability has yet to be addressed by the development team, and more than one year has passed.
Bleeping Computer reported that more than 3.5 million Exim servers are exposed online.
The only way to mitigate the risk of exploitation for the above issue, is to restrict interaction with the application.
“Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application,” concludes ZDI.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Exim mail transfer)
Security Affairs Malware newsletter includes a collection of the best articles and research on malware…
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best…
Hundreds of Porsche cars in Russia became undrivable due to a malfunction in their factory-installed…
A hacking campaign is targeting GlobalProtect logins and scannig SonicWall APIs since December 2, 2025.…
A maximum severity vulnerability in Apache Tika, tracked as CVE-2025-66516 (CVSS score of 10.0), allows…
Array Networks AG gateways have been under active exploitation since August 2025 due to a…
This website uses cookies.
