CVE-2020-7247: OpenSMTPD MAIL FROM command injection allows remote root code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution as root in a default configuration, with public exploits, KEV listing and near-maximum EPSS probability.

What it is

OpenSMTPD 6.6, as shipped in OpenBSD 6.6 and other products, mishandles input validation in smtp_mailaddr in smtp_session.c, returning an incorrect value on validation failure. A remote attacker can inject shell metacharacters through the MAIL FROM field of an SMTP session and execute arbitrary commands as root. The flaw affects the default uncommented configuration, so exposed mail servers need no special setup to be at risk.

Impact

An unauthenticated remote attacker gains arbitrary command execution with root privileges on the mail server. That yields full control of the host, including mail data, credentials and any services reachable from it.

Attack surface

Reachable over the network through the SMTP service on port 25 by sending a crafted MAIL FROM value; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Only systems running the affected OpenSMTPD 6.6 default configuration are exposed.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-25, and EPSS shows a 30-day probability of 0.98972 (99.9th percentile). Multiple public references are tagged Exploit, so working exploit code is publicly available.

What to do

• Patch OpenSMTPD to a fixed release immediately; apply the OpenBSD source commit 9dcfda045474d8903224d175907bfc29761dcb45 or the vendor update for your distribution (Debian DSA-4611, Ubuntu USN-4268-1, Fedora advisory).
• If patching cannot be done at once, restrict SMTP access to trusted networks and hosts with firewall rules rather than leaving port 25 open to the internet.
• Verify the running smtpd version and confirm the default uncommented configuration is not in use on internet-facing hosts.
• Monitor vendor and CISA KEV guidance for the required remediation deadline and confirm completion before 2022-04-15-style due dates for any remaining instances.

Detection

• Inspect SMTP logs for MAIL FROM values containing shell metacharacters such as backticks, semicolons, pipes or command substitution syntax.
• Alert on unexpected child processes spawned by the smtpd process, especially shells or commands not normally invoked by the mail daemon.
• Hunt for outbound connections or file writes originating from the mail server host that do not match normal mail relay behavior.
• Check host and package inventories for OpenSMTPD 6.6 and confirm the patched version is installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.