← Vulnerability feed

Vulnerability record · CVE-2019-7212 · published 24 April 2019

CVE-2019-7212: Smartertools smartermail hard-coded credentials vulnerability

Smartertools · Smartermail

SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. It was also possible to interact with mailing lists.

8.2 CVSS 3.0 High EPSS 1.0% · top 38.4% CWE-798 · Hard-coded credentials
8.2CVSS 3.0 base score, v2 6.4
1.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. It was also possible to interact with mailing lists.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/ Third Party Advisory
https://www.smartertools.com/smartermail/release-notes/current ExploitRelease NotesVendor Advisory
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/ Third Party Advisory
https://www.smartertools.com/smartermail/release-notes/current ExploitRelease NotesVendor Advisory

Track CVE-2019-7212 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-52691SmarterMail unauthenticated arbitrary file upload leading to RCESmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434) that lets an unauthenticated attacker write files to any location on the…KEVEPSS 86%analysed9.3CVE-2026-24423SmarterMail ConnectToHub API unauthenticated remote code executionSmarterTools SmarterMail builds prior to 9511 expose the ConnectToHub API method without authentication, allowing an attacker to redirect the applica…KEVEPSS 88%analysed9.3CVE-2026-23760SmarterMail password reset API authentication bypassSmarterMail builds prior to 9511 expose a force-reset-password endpoint that accepts anonymous requests and does not verify the current password or a…KEVEPSS 97%analysed9.8CVE-2021-32234Smartertools smartermail vulnerabilitySmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.EPSS 2.2%9.8CVE-2019-7214SmarterMail deserialization of untrusted data enables unauthenticated RCESmarterTools SmarterMail 16.x before build 6985 deserializes untrusted data, letting an unauthenticated attacker execute commands on the server when …EPSS 85%analysed8.7CVE-2026-7807Smartertools smartermail path traversal vulnerabilitySmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that all…EPSS 0.34%8.2CVE-2026-40514Smartertools smartermail vulnerabilitySmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption wi…EPSS 0.26%8.1CVE-2020-29548Smartertools smartermail command injection vulnerabilityAn issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS comma…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2019-7212), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.