Vulnerability record · CVE-2010-4345 · published 14 December 2010
CVE-2010-4345: Exim local privilege escalation via alternate config file command injection
Exim · Exim
Exim 4.72 and earlier lets the exim user account specify an alternate configuration file whose directives can contain arbitrary commands, as shown with the spool_directory directive. A local user who can influence that configuration path can execute commands as the exim user, which is a privilege escalation on affected mail servers.
Description
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with a high EPSS percentile and public exploit tooling, but requires local access and affects an old Exim version.
What it is
Exim 4.72 and earlier lets the exim user account specify an alternate configuration file whose directives can contain arbitrary commands, as shown with the spool_directory directive. A local user who can influence that configuration path can execute commands as the exim user, which is a privilege escalation on affected mail servers.
Impact
An attacker gains the privileges of the exim user account and can run arbitrary commands, potentially leading to full root compromise depending on local configuration. This is a local escalation, not remote code execution by itself.
Attack surface
Reached locally; the CVSS vector is AV:L/PR:L/UI:N, so the attacker needs a local account and low privileges, with no user interaction. No network vector or authentication bypass is described.
Exploitation
CISA KEV lists it as exploited with a 2022-04-15 remediation due date, and EPSS is 0.18105 (97th percentile), indicating meaningful exploitation activity. Reference tags include Patch and a Metasploit module link, so public exploit tooling exists.
What to do
- Apply the vendor patch for Exim and the listed distributions (Debian, Ubuntu, openSUSE) per their advisories.
- Restrict who can write or point Exim at alternate configuration files, and audit config file ownership and permissions.
- Run Exim with least privilege and avoid configurations that let the exim user invoke arbitrary commands.
- Monitor and limit local accounts on mail servers, since exploitation requires local access.
Detection
- Audit Exim configuration files and startup arguments for unexpected alternate config paths or spool_directory values.
- Alert on processes spawned by the exim user that are not normal mail handling activity.
- Review local account creation and privilege changes on mail servers for signs of pre-exploitation staging.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2010-4345 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "Exim Privilege Escalation Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 April 2022.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-4345 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-4345), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
