CVE-2026-24423

CRITICALCISA KEV

9.8

Descripcion

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado1/23/2026

Ultima modificacion2/6/2026

Fuentekev

Avistamientos honeypot0

CISA KEV

VendedorSmarterTools

ProductoSmarterMail

Nombre vulnerabilidadSmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

Fecha inclusion KEV2026-02-05

Fecha limite remediacion2026-02-26

Uso en ransomwareKnown

Productos afectados

smartertools:smartermail

Debilidades (CWE)

CWE-306

Referencias

https://code-white.com/public-vulnerability-list/#systemadminsettingscontrollerconnecttohub-missing-authentication-in-smartermail(disclosure@vulncheck.com)

https://www.smartertools.com/smartermail/release-notes/current(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api(disclosure@vulncheck.com)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24423(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.