CVE-2024-5670

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
SoftnextSN OS 12.1< 230922
SoftnextSN OS 12.3< 230922
SoftnextSN OS 10.3< 230631
softnextmail_sqr_expert>= 12.1, < 230922; >= 12.3, < 230922; >= 10.3, < 230631
softnextmail_archiving_expert>= 12.1, < 230922; >= 12.3, < 230922; >= 10.3, < 230631

References

Timeline

Published
Jul 29, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-567005.5In the Linux kernel, the following vulnerability has been resolved: media: wl128x: Fix atomicity violation in fmc_send_cmd() Atomicity vioCVE-2024-567015.5In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore The dtl_acceCVE-2024-567025.5In the Linux kernel, the following vulnerability has been resolved: bpf: Mark raw_tp arguments with PTR_MAYBE_NULL Arguments to a raw tracCVE-2024-567035.5In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix soft lockups in fib6_select_path under high next hop churn SCVE-2024-567047.8In the Linux kernel, the following vulnerability has been resolved: 9p/xen: fix release of IRQ Kernel logs indicate an IRQ was double-freeCVE-2024-567055.5In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for rgby_data memory allocation failure In iCVE-2024-567066.3In the Linux kernel, the following vulnerability has been resolved: s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex ResCVE-2024-567075.5In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c Add eCVE-2024-567087.8In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Avoid segmentation fault on module unload The segmentationCVE-2024-567095.5In the Linux kernel, the following vulnerability has been resolved: io_uring: check if iowq is killed before queuing task work can be execCVE-2024-56719.8Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution anCVE-2024-567105.5In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_direct_read_write() The bvecs array whic
CVE-2024-5670: Critical severity, CVSS 9.8 | Vulnix