CVE-2020-28024: Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only…

PriorityP267critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

4.07%

89.4th percentile

Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can actually push back non-character error codes such as EOF.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	exim4	< exim4 4.94.2-1 (bookworm)	exim4 4.94.2-1 (bookworm)
exim	exim	>= 4.00 < 4.94.2	4.94.2

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability exists in Exim 4 versions before 4.94.2; target the smtp_ungetc function which can push back non-character error codes such as EOF, enabling a buffer underwrite condition ↗

·Attack vector is unauthenticated and remote; no prior authentication or credentials are required to trigger the buffer underwrite via the SMTP protocol ↗
·Debian scopes this as 'local' severity despite the NVD description indicating remote exploitability; verify your threat model accordingly ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

osv9.8CRITICAL

vendor_debian9.8CRITICAL

vendor_ubuntu9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.