Seppmail Ag
Monthly
Command injection in SEPPmail Secure Email Gateway before version 15.0.7 enables authenticated administrators to execute operating system commands at elevated privilege levels beyond the intended administrative scope. Classified CWE-78, the flaw exists within the network-accessible management interface and was reported by NCSC.ch (Swiss National Cybersecurity Centre). No active exploitation or public proof-of-concept code has been identified at time of analysis; the vendor-released fix is available in version 15.0.7.
Arbitrary OS command execution in SEPPmail Secure Email Gateway before 15.0.6 is possible via CWE-502 deserialization in the privileged REST API import workflow. An attacker who holds a privileged API token can submit a crafted serialized payload to the import endpoint and trigger command execution under the 'nobody' system account. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis, but the attack pattern for deserialization vulnerabilities is well understood.
SEPPmail Secure Email Gateway (SEG) before 15.0.7 establishes a fully privileged session prior to completing multi-factor authentication enrollment, allowing an attacker who possesses credentials for an MFA-required but not-yet-enrolled account to bypass the second factor entirely. The flaw is a session lifecycle error - the gateway incorrectly grants access rights before the enrollment ceremony is finished, collapsing MFA to single-factor authentication for affected accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though NCSC.ch has reported the issue, suggesting coordinated disclosure with the Swiss vendor.
Path traversal in SEPPmail Secure Email Gateway versions before 15.0.5 allows authenticated remote attackers to write files outside the intended directory by manipulating attachment filenames processed during encrypted PDF generation. Files can be placed in web-accessible locations, enabling potential webshell deployment and integrity compromise. No public exploit identified at time of analysis; the issue was reported by NCSC.ch and is fixed in 15.0.5.
Authorization bypass in SEPPmail Secure Email Gateway versions prior to 15.0.4 enables remote unauthenticated attackers to access privileged GINA UI endpoints without authentication. The vulnerability (CISA reported by Swiss NCSC) affects core access control mechanisms with CVSS 9.3 critical severity, allowing complete system compromise through network-accessible administrative interfaces. No active exploitation (CISA KEV) or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication barrier presents immediate risk to internet-facing deployments.
Remote code execution in SEPPmail Secure Email Gateway versions before 15.0.4 allows unauthenticated attackers to execute arbitrary template expressions through a server-side template injection flaw in the GINA UI endpoint. The vulnerability requires no authentication and has low attack complexity, but depends on specific template plugin configurations (CVSS 4.0: 8.3 High with AT:P indicating present attack conditions). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available.
Remote code execution in SEPPmail Secure Email Gateway versions prior to 15.0.2.1 enables unauthenticated attackers to execute arbitrary Perl code via the GINA UI. The vulnerability stems from an endpoint passing unsanitized user input directly to Perl's eval function, allowing complete system compromise. Reported by Switzerland's national CERT (NCSC.ch), this represents a critical pre-authentication attack surface requiring immediate patching.
Remote unauthenticated attackers can read arbitrary local files and trigger deletion of targeted files in SEPPmail Secure Email Gateway versions before 15.0.4 through path traversal in the /api.app/attachment/preview endpoint. The vulnerability allows exploitation without authentication or user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), enabling attackers to exfiltrate sensitive configuration files, credentials, or email data, and selectively delete files with api.app process privileges. No active exploitation confirmed by CISA KEV at time of analysis, though the unauthenticated remote attack vector and file manipulation capabilities represent elevated risk for exposed email gateway appliances. Swiss NCSC disclosure suggests vendor-coordinated remediation.
SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the GINA UI, allowing remote attackers to retrieve sensitive system information including configuration details, internal paths, and potentially credentials. The vulnerability requires only network access to the affected endpoint with no authentication, authentication complexity, or user interaction; it is classified as an information disclosure flaw with limited confidentiality impact (CVSS 6.9).
Command injection in SEPPmail Secure Email Gateway before version 15.0.7 enables authenticated administrators to execute operating system commands at elevated privilege levels beyond the intended administrative scope. Classified CWE-78, the flaw exists within the network-accessible management interface and was reported by NCSC.ch (Swiss National Cybersecurity Centre). No active exploitation or public proof-of-concept code has been identified at time of analysis; the vendor-released fix is available in version 15.0.7.
Arbitrary OS command execution in SEPPmail Secure Email Gateway before 15.0.6 is possible via CWE-502 deserialization in the privileged REST API import workflow. An attacker who holds a privileged API token can submit a crafted serialized payload to the import endpoint and trigger command execution under the 'nobody' system account. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis, but the attack pattern for deserialization vulnerabilities is well understood.
SEPPmail Secure Email Gateway (SEG) before 15.0.7 establishes a fully privileged session prior to completing multi-factor authentication enrollment, allowing an attacker who possesses credentials for an MFA-required but not-yet-enrolled account to bypass the second factor entirely. The flaw is a session lifecycle error - the gateway incorrectly grants access rights before the enrollment ceremony is finished, collapsing MFA to single-factor authentication for affected accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though NCSC.ch has reported the issue, suggesting coordinated disclosure with the Swiss vendor.
Path traversal in SEPPmail Secure Email Gateway versions before 15.0.5 allows authenticated remote attackers to write files outside the intended directory by manipulating attachment filenames processed during encrypted PDF generation. Files can be placed in web-accessible locations, enabling potential webshell deployment and integrity compromise. No public exploit identified at time of analysis; the issue was reported by NCSC.ch and is fixed in 15.0.5.
Authorization bypass in SEPPmail Secure Email Gateway versions prior to 15.0.4 enables remote unauthenticated attackers to access privileged GINA UI endpoints without authentication. The vulnerability (CISA reported by Swiss NCSC) affects core access control mechanisms with CVSS 9.3 critical severity, allowing complete system compromise through network-accessible administrative interfaces. No active exploitation (CISA KEV) or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication barrier presents immediate risk to internet-facing deployments.
Remote code execution in SEPPmail Secure Email Gateway versions before 15.0.4 allows unauthenticated attackers to execute arbitrary template expressions through a server-side template injection flaw in the GINA UI endpoint. The vulnerability requires no authentication and has low attack complexity, but depends on specific template plugin configurations (CVSS 4.0: 8.3 High with AT:P indicating present attack conditions). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available.
Remote code execution in SEPPmail Secure Email Gateway versions prior to 15.0.2.1 enables unauthenticated attackers to execute arbitrary Perl code via the GINA UI. The vulnerability stems from an endpoint passing unsanitized user input directly to Perl's eval function, allowing complete system compromise. Reported by Switzerland's national CERT (NCSC.ch), this represents a critical pre-authentication attack surface requiring immediate patching.
Remote unauthenticated attackers can read arbitrary local files and trigger deletion of targeted files in SEPPmail Secure Email Gateway versions before 15.0.4 through path traversal in the /api.app/attachment/preview endpoint. The vulnerability allows exploitation without authentication or user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), enabling attackers to exfiltrate sensitive configuration files, credentials, or email data, and selectively delete files with api.app process privileges. No active exploitation confirmed by CISA KEV at time of analysis, though the unauthenticated remote attack vector and file manipulation capabilities represent elevated risk for exposed email gateway appliances. Swiss NCSC disclosure suggests vendor-coordinated remediation.
SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the GINA UI, allowing remote attackers to retrieve sensitive system information including configuration details, internal paths, and potentially credentials. The vulnerability requires only network access to the affected endpoint with no authentication, authentication complexity, or user interaction; it is classified as an information disclosure flaw with limited confidentiality impact (CVSS 6.9).