SmarterMail < 100.0.9511 Unauthenticated RCE via ConnectToHub API (CVE-2026-24423)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(298241);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/27");

  script_cve_id("CVE-2026-24423");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/02/26");

  script_name(english:"SmarterMail < 100.0.9511 Unauthenticated RCE via ConnectToHub API (CVE-2026-24423)");

  script_set_attribute(attribute:"synopsis", value:
"The remote mail server is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of SmarterTools SmarterMail installed on the remote host is prior to 100.0.9511. It is,
therefore, affected by a remote code execution vulnerability. SmarterTools SmarterMail versions prior to
build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method.
The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command.
This command will be executed by the vulnerable application.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://www.vulncheck.com/advisories/smartertools-smartermail-unauthenticated-rce-via-connecttohub-api
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fe78a2a7");
  script_set_attribute(attribute:"solution", value:
"Upgrade to SmarterTools SmarterMail version 100.0.9511 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-24423");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:smartertools:smartermail");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smartertools_smartermail_detect.nbin");
  script_require_keys("installed_sw/SmarterTools SmarterMail");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'SmarterTools SmarterMail', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [{'fixed_version': '100.0.9511'}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);