CVE-2020-7247VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2020-7247: OpenSMTPD Remote Code Execution Vulnerability

Affects OpenBSD OpenSMTPDSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 99.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-7247 (opens in a new tab)

Description

CVE-2020-7247 is a high-severity remote code execution vulnerability in OpenSMTPD's smtp_mailaddr function. It allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

The vulnerability exists in the smtp_mailaddr function within smtp_session.c of OpenSMTPD, a component used in OpenBSD and other products. It enables remote attackers to execute arbitrary commands with root privileges by sending a specially crafted SMTP session. The vulnerability is identified as CVE-2020-7247 and is associated with CWE-755 (Improper Handling of Exceptional Conditions) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Exploitation in the wild has been confirmed, but no patch or remediation details are provided in the input data.

Impact

Successful exploitation allows remote attackers to execute arbitrary commands as root, which can lead to full system compromise. This represents a critical impact on confidentiality, integrity, and availability of affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SMTP service and monitor for suspicious activity related to SMTP sessions.

CVE-2020-7247: OpenSMTPD Remote Code Execution Vulnerability

What to do

Description

Summary

Impact

Mitigation

Weaknesses

References

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:10:52 UTC

Weaknesses

References

Related threats