materaj2/cve-2026-45185-detection-script
These detection scripts are property of the SECPlayground Platform. Two safe detection scripts. Neither drives the close_notify-mid-BDAT trigger, so they will not crash the daemon or leave panic-log entries. Both verdicts are "likely vulnerable" — distinguishing GnuTLS from OpenSSL builds remotely is not reliable without exploitation.
(c) SECPlayground Platform — https://www.secplayground.com
These detection scripts are property of the SECPlayground Platform.
Two safe detection scripts. Neither drives the close_notify-mid-BDAT trigger, so they will not crash the daemon or leave panic-log entries.
Both verdicts are "likely vulnerable" — distinguishing GnuTLS from OpenSSL builds remotely is not reliable without exploitation.
# from the lab dir, against the running container
nuclei -t detect/CVE-2026-45185.yaml -u 127.0.0.1:2525
# scan a netblock on common SMTP ports
nuclei -t detect/CVE-2026-45185.yaml -l targets.txt
The template probes ports 25,465,587,2525 and matches when all three
are true: Exim version 4.97-4.99.2, STARTTLS advertised, CHUNKING
advertised.
# single host
nmap -p 2525 --script ./detect/cve-2026-45185.nse 127.0.0.1
# discovery sweep across SMTP ports
nmap -p 25,465,587,2525 --script ./detect/cve-2026-45185.nse 10.0.0.0/24
# install globally (optional)
sudo cp detect/cve-2026-45185.nse /usr/share/nmap/scripts/
sudo nmap --script-updatedb
nmap -p 2525 --script cve-2026-45185 127.0.0.1