CVE-2012-10046CWE-78

E-Mail Security Virtual Appliance learn-msg.cgi Command Injection

Critical · published August 8, 2025

CVSS v4.0
9.3
EPSS
4%
Percentile
90.8
In the wild
Unconfirmed
What it is

The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and results in full command execution on the underlying system.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.04187 · 90.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-08-08T18:11Z
EPSS history
Timeline
  • 08 AUG 18:11Z
    E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
    cvelistv5