SMTP.RCPT.TO.Command.Injection

Description

This indicates an attack attempt to exploit a Command Injection vulnerability in SMTP servers.
The vulnerability is due to insufficient validation of user-supplied inputs. A remote attacker can exploit this vulnerability by sending maliciously crafted SMTP RCPT TO commands to a vulnerable SMTP server. Successful exploitation could result in arbitrary command execution in the security context of the application.

Outbreak Alert

Threat Actors are exploiting a recently fixed RCE vulnerability in Zimbra email servers, which can be exploited just by sending specially crafted emails to the SMTP server.

View the full Outbreak Alert Report

Affected Products

Zimbra Collaboration (ZCS) version 8.8.15 prior to Patch 46
Zimbra Collaboration (ZCS) version 9.0.0 versions prior to patch 41
Zimbra Collaboration (ZCS) versions prior to 10.1.1

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the latest patch to the vulnerable software.