SEPPmail Secure Email Gateway flaws allow command execution and file access
A mail security relay device can be hacked from outside!
Summary
Before 15.1.1, SEPPmail Secure Email Gateway lets an unauthenticated remote sender run operating-system commands during mail processing. The same product also has flaws allowing file reads and deletes, service stalls, and email address exposure.
Affected when
- An active sender or recipient replacement rule that uses message data and whose search condition matches
- Large File Transfer (LFT) enabled
- GINA web interface in use
- An unregistered GINA account with an empty initial password exists
What to do
Update to version 15.1.1 or later.
Products and platforms
CVE IDs
Sources
Times
First published
First seen