Read the docs
TI-2020-18295 Aliases CVE-2020-35851GHSA-f62f-7p64-pmrv

HGiga MailSherlock - Command Injection

Priority MEDIUM 46CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system.

Why it matters now

EPSS 0.01759 78th percentileScored 2026-11-07
Fix Fixed MailSherlock MSR45/SSR45 (HGiga): 115

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HGigaMailSherlock MSR45/SSR45before 115115Patch availableCNA
  • MailSherlock MSR45/SSR45 VendorHGiga Affected before 115 Fixed in 115 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:*before 4.5-115VulnerableHGiga
cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:*before 4.5-115VulnerableHGiga
  • cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-115 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-115 Vulnerable ·HGiga

Remediation

  • Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 115

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35851
  2. 2026-10-03 Alias added: GHSA-f62f-7p64-pmrv

References

Advisory 1

  • TI-2020-15839 HGiga MailSherlock - Broken Authentication CVSS 3.1CRITICAL 9.8
  • TI-2021-05709 HGiga MailSherlock - SQL Injection-2 CVSS 3.1CRITICAL 9.8
  • TI-2019-07262 Cross-site request forgery in HGiga MailSherlock MSR35 CVSS 3.0HIGH 8.8
  • TI-2019-07261 Cross-site request forgery in HGiga MailSherlock MSR35 CVSS 3.0HIGH 8.8
  • TI-2020-15841 HGiga MailSherlock - Arbitrary File Download CVSS 3.1HIGH 8.1
  • TI-2020-18199 HGiga MailSherlock - SQL Injection -3 CVSS 3.1HIGH 7.6
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences