Vulnerability record · CVE-2004-1520 · published 31 December 2004
CVE-2004-1520: IPSwitch IMail IMAP DELETE stack buffer overflow
Ipswitch · Imail
IPSwitch IMail 8.13 contains a stack-based buffer overflow reachable through a long IMAP DELETE command. A remote authenticated user can trigger the overflow and execute arbitrary code on the mail server. The flaw matters because it lets a low-privileged mail account compromise the underlying host.
Description
Stack-based buffer overflow in IPSwitch IMail 8.13 allows remote authenticated users to execute arbitrary code via a long IMAP DELETE command.
AV:L/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote code execution with public exploit material and very high EPSS, though it requires valid IMAP credentials and affects an old product version.
What it is
IPSwitch IMail 8.13 contains a stack-based buffer overflow reachable through a long IMAP DELETE command. A remote authenticated user can trigger the overflow and execute arbitrary code on the mail server. The flaw matters because it lets a low-privileged mail account compromise the underlying host.
Impact
An attacker with valid IMAP credentials gains arbitrary code execution in the context of the IMail service, potentially leading to full server compromise. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.
Attack surface
The flaw is reached over the network through the IMAP service by sending an oversized DELETE command. Authentication is required per the description, and no user interaction beyond issuing the crafted command is needed.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high at 0.885 (99.8th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.
What to do
- Apply the vendor patch referenced in the Secunia advisory for IMail 8.13.
- Restrict IMAP access to trusted networks and disable the service where it is not required.
- Enforce strong authentication and least privilege on mail accounts to limit who can reach the vulnerable command.
- Monitor and filter oversized or malformed IMAP DELETE commands at the perimeter.
- Upgrade to a supported IMail release if 8.13 is still in use.
Detection
- Inspect IMAP server logs for abnormally long DELETE commands or malformed IMAP syntax.
- Alert on IMail service crashes or restarts that coincide with IMAP DELETE activity.
- Monitor for unexpected child processes or outbound connections spawned by the IMail service.
- Use network IDS signatures for oversized IMAP DELETE requests against port 143 or 993.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-1520 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-1520), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
