CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
- Published
- Jan 29, 2020
- Updated
- Oct 21, 2025
- Assigning CNA
- mitre
- Evidence observed
- Jan 30, 2020
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 16, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Sources
opensmtpd/CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability (CVE-2020-7247)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/opensmtpd:6.6.1p1(opensmtpd/CVE-2020-7247/docker-compose.yml:services.smtpd.image)
modules/exploits/unix/smtp/opensmtpd_mail_from_rce.rb
Metasploit Framework modulesDeclared conditions
- platform: Unix($.exploit_unix/smtp/opensmtpd_mail_from_rce.platform)
- verification: check_declared($.exploit_unix/smtp/opensmtpd_mail_from_rce.check)
javascript/cves/2020/CVE-2020-7247.yaml
Nuclei TemplatesDeclared conditions
- verification: dsl,word($.matchers[*].type)
- oob: interactsh_reference($.template_text)
- exploitsExploit
Public exploit repository covering local privilege escalation, buffer overflows, and database exploits across Linux, Solaris, AIX, OpenBSD, Zyxel, Oracle, and MySQL.
- CVE-2020-7247Exploit
This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtp_mailaddr()” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user
- CVE-2020-7247Exploit
Proof-of-concept remote code execution exploit targeting OpenSMTPD versions 6.4.0 to 6.6.1, delivering a reverse shell via crafted SMTP commands.
- cve-2020-7247-exploitExploit
Python exploit of cve-2020-7247
- CVE-2020-7247-reproducerExploit
Docker-based environment to reproduce CVE-2020-7247 (OpenSMTPD) with a Python exploit script for arbitrary command execution and reverse shell via crafted SMTP MAIL FROM field.
- CVE-2020-7247-exploitExploit
OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution PoC exploit
- CVE-2020-7247Exploit
Proof Of Concept Exploit for CVE-2020-7247 (Remote Execution on OpenSMTPD < 6.6.2
Proof of concept for CVE-2020-7247 for educational purposes.
- cve-2020-7247Exploit
OpenSMTPD version 6.6.2 remote code execution exploit
- local-exploitsExploit
Various local exploits
- shai_huludExploit
Worm written in python, abuses CVE-2020-7247
Docker-based lab demonstrating CVE-2020-7247 remote code execution in OpenSMTPD 6.6.1p1 with a Python PoC for educational security testing.
1F98D · linux · Jan 30, 2020
Metasploit · linux · Feb 10, 2020
Marco Ivaldi · openbsd · Feb 11, 2020
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.