Read the docs
TI-2017-04157 Aliases CVE-2017-6327GHSA-x45p-q5pf-h9jx

Command injection in Symantec Messaging Gateway

Priority CRITICAL 97Exploited in the wildCWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.

Summary

The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.35911 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecMessaging GatewayAll versions prior to version 10.6.3-267—No fix listedCNA
  • Messaging Gateway VendorSymantec Affected All versions prior to version 10.6.3-267 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:message_gateway:*:*:*:*:*:*:*:*before 10.6.3-267VulnerableSymantec
  • cpe:2.3:a:symantec:message_gateway:*:*:*:*:*:*:*:* Versions before 10.6.3-267 Vulnerable ·Symantec

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2021-11-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2017-6327
  3. 2026-10-03 Alias added: GHSA-x45p-q5pf-h9jx

References

Exploit 1

Advisory 2

  • TI-2016-02020 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 7.8
  • TI-2016-03091 Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec… CVSS 3.0CRITICAL 9.8
  • TI-2016-03092 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 8.4
  • TI-2016-03090 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 8.4
  • TI-2016-02016 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 8.4
  • TI-2016-02018 Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced… CVSS 3.0HIGH 7.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences