CVE-2013-6829: PineApp Mail-SeCure ping host parameter command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated remote command execution on an internet-facing mail security appliance, with very high EPSS despite no KEV listing.

What it is

The admin/confnetworking.html page in PineApp Mail-SeCure passes the pinghost parameter to a ping operation without sanitizing shell metacharacters, allowing command injection. An attacker who can reach that page can run arbitrary commands on the appliance, which is a security gateway sitting on the mail path.

Impact

Successful exploitation gives the attacker arbitrary command execution with the privileges of the web service, enabling full compromise of the appliance and any mail or credentials it handles.

Attack surface

Reachable over the network via HTTP to admin/confnetworking.html; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required, though the page path suggests an administrative interface.

Exploitation

Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is 0.79871 (99.59th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Apply the vendor fix for PineApp Mail-SeCure if still supported; if no patch exists, retire or isolate the appliance.
• Restrict network access to admin/confnetworking.html and the management interface to trusted administrative networks only.
• Validate and reject shell metacharacters in the pinghost parameter, or replace the ping call with a non-shell API.
• Run the web service under a least-privilege account and monitor it for unexpected child processes.
• Place the appliance behind a WAF or reverse proxy that blocks metacharacter payloads in ping parameters.

Detection

• Search web logs for requests to admin/confnetworking.html with pinghost values containing shell metacharacters such as ;, |, &, $, or backticks.
• Alert on unexpected child processes spawned by the Mail-SeCure web service, especially shells or network utilities.
• Monitor for outbound connections from the appliance to unfamiliar hosts, which may indicate injected reverse shells or downloads.
• Review authentication and access logs for unauthenticated or anomalous access to the admin interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.