Read the docs
TI-2024-05265 Aliases CVE-2024-5670GHSA-gg52-x92p-v5qj

Softnext Mail SQR Expert and Mail Archiving Expert - OS Command Injection

Priority MEDIUM 51CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00898 59th percentileScored 2026-11-07
Fix Fixed SN OS 12.1 (Softnext): 230922SN OS 12.3 (Softnext): 230922+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SoftnextSN OS 12.1before 230922230922Patch availableCNA
SoftnextSN OS 12.3before 230922230922Patch availableCNA
SoftnextSN OS 10.3before 230631230631Patch availableCNA
  • SN OS 12.1 VendorSoftnext Affected before 230922 Fixed in 230922 Patch available CNA
  • SN OS 12.3 VendorSoftnext Affected before 230922 Fixed in 230922 Patch available CNA
  • SN OS 10.3 VendorSoftnext Affected before 230631 Fixed in 230631 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:softnext:sn_os:10.3:-:*:*:*:*:*:*10.3VulnerableSoftnext
cpe:2.3:o:softnext:sn_os:12.1:-:*:*:*:*:*:*12.1VulnerableSoftnext
cpe:2.3:o:softnext:sn_os:12.3:-:*:*:*:*:*:*12.3VulnerableSoftnext
  • cpe:2.3:o:softnext:sn_os:10.3:-:*:*:*:*:*:* Versions 10.3 Vulnerable ·Softnext
  • cpe:2.3:o:softnext:sn_os:12.1:-:*:*:*:*:*:* Versions 12.1 Vulnerable ·Softnext
  • cpe:2.3:o:softnext:sn_os:12.3:-:*:*:*:*:*:* Versions 12.3 Vulnerable ·Softnext

Remediation

  • Fix · CNA SN OS 12.1 (Softnext) Fixed in 230922
  • Fix · CNA SN OS 12.3 (Softnext) Fixed in 230922
  • Fix · CNA SN OS 10.3 (Softnext) Fixed in 230631

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-5670
  2. 2026-10-03 Alias added: GHSA-gg52-x92p-v5qj

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences