CVE-2026-24423
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-02-06
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| smartertools | smartermail | to 100.0.9511 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24423 is a critical unauthenticated remote code execution vulnerability in SmarterTools SmarterMail versions prior to build 9511. It exists in the ConnectToHub API method, which lacks proper authentication. An attacker can exploit this by directing the vulnerable SmarterMail instance to a malicious HTTP server that serves a crafted operating system command. This command is executed by the application without any authentication or user interaction, allowing the attacker to run arbitrary code remotely. [1]
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary operating system commands remotely on the affected SmarterMail server without any authentication. This can lead to full compromise of the system, including unauthorized access, data theft, data manipulation, service disruption, and potentially complete control over the affected server. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring network traffic for attempts to access the ConnectToHub API method without authentication or unusual HTTP requests pointing to external servers serving commands. Specific commands are not provided in the resources, but generally, you can use network monitoring tools like Wireshark or tcpdump to capture HTTP requests to the SmarterMail server, and grep logs for ConnectToHub API access attempts. Additionally, scanning for SmarterMail versions prior to build 9511 can help identify vulnerable instances. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update SmarterMail to build 9511 or later, as this version contains the fix for the unauthenticated remote code execution vulnerability in the ConnectToHub API method. [1]