CVE-2007-1373: Mercury/32 Mail Transport System LOGIN command stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score is 10.0 with network reachability, no authentication and full confidentiality, integrity and availability impact, and public exploit material is referenced.

What it is

Mercury/32 (Mercury Mail Transport System) 4.01b and earlier contains a stack-based buffer overflow reachable through a long LOGIN command. A remote attacker can trigger the overflow and potentially execute arbitrary code on the mail server. The record notes it may be the same issue as CVE-2006-5961, so the exact distinct root cause is not fully settled.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the Mercury/32 service, which typically runs with system or service-level privileges. That means full compromise of the mail server, including reading mail data and pivoting to the host.

Attack surface

The flaw is network-reachable (AV:N, AC:L, Au:N) with no authentication and no user interaction required, per the CVSS 2.0 vector. It is reached by sending a crafted LOGIN command to the affected service.

Exploitation

No CISA KEV listing and no ransomware associations are recorded, but EPSS is very high (0.58687, 99th percentile) and the references include an Exploit-tagged full-disclosure post, indicating public exploit material exists.

What to do

• Upgrade Mercury/32 past 4.01b to a fixed release; confirm the vendor advisory (Secunia 24367) for the corrected version.
• If patching is not immediately possible, restrict network access to the Mercury SMTP/POP3/IMAP listeners to trusted hosts only.
• Enforce strict input length limits on the LOGIN command at any front-end proxy or filter if one is in the path.
• Run the Mercury/32 service under a least-privilege account rather than a highly privileged one.
• Monitor vendor and CVE-2006-5961 references to confirm whether this is a duplicate and apply the corresponding fix.

Detection

• Inspect mail service logs for abnormally long LOGIN command strings or malformed authentication attempts.
• Alert on crashes or restarts of the Mercury/32 process, which can indicate a failed overflow attempt.
• Use network IDS signatures for oversized LOGIN commands against the Mercury service port.
• Correlate outbound connections or child processes spawned by the mail service with unexpected behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.