CVE-2019-7214

critical

Description

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

References

https://www.smartertools.com/smartermail/release-notes/current

https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/

http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html

http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html

Details

Source: Mitre, NVD

Published: 2019-04-24

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.84824