CVE-2019-10149: Exim Mail Transfer Agent (MTA) Improper Input Validation

CVSS: 10.0v2.0HighKEVAnalyzed

AliasesUBUNTU-CVE-2019-10149USN-4010-1DEBIAN-CVE-2019-10149+2 more

Published 05-06-2019Last modified 21-10-2025

Vulnerability summary

CVE-2019-10149 is a high (CVSS 10.0) OS Command Injection vulnerability in Exim Mail Transfer Agent (MTA). It is known to be exploited: CISA lists it, first on 10-01-2022. EPSS estimates a 99.96% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 9 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

99.96%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits9reference, metasploit, exploit-database

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2021:0753-1 OPENSUSE-SU-2024:10746-1

Timeline

05-06-2019
PublishedVulnerability first disclosed.
10-01-2022
Added to CISA KEVExim Mail Transfer Agent (MTA) Improper Input Validation
10-07-2022
CISA remediation dueApply updates per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

CVSS metrics

7 scores · 4 sources · 3 versions

v3.19.8v3.09.0v2.010.0

EPSS trend

Probability

99.96%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 99.96% on 21-09-2026

21-09-202621-10-2026

EPSS score

99.96%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 10-01-2022
Federal due date: 10-07-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-10149

Public exploits

9 found

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 9 exploits

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
MetasploitremoteVerified
Exim 4.87 - 4.91 Local Privilege Escalation
exploit/linux/local/exim4_deliver_message_priv_esc
Maturity: weaponized
exploit-databaselocallinuxVerified
Exim 4.87 - 4.91 - Local Privilege Escalation
Maturity: weaponized
exploit-databaselocallinuxVerified
Exim 4.87 / 4.91 - Local Privilege Escalation (Metasploit)
Maturity: weaponized
exploit-databaseremotelinuxUnverified
Exim 4.87 < 4.91 - (Local / Remote) Command Execution
Maturity: poc

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Debian2 products

exim4< 4.92~RC3-1 | < 4.89-2+deb9u4
debian_linuxEOL9.0

Opensuse2 products

exim&distro=openSUSE Leap 15.0< 4.88-lp151.4.3.1
exim&distro=openSUSE Leap 15.1< 4.88-lp151.4.3.1

Canonical1 product

ubuntu_linuxEOL18.04 | 18.10

Exim1 product

eximEOL4.92 | ≥ 4.87, ≤ 4.91

Ubuntu1 product

exim4< 4.90.1-1ubuntu1.2

5 vendors · 7 products

References

30 links

www.openwall.com/lists/oss-security/2019/06/05/2Mailing ListThird Party Advisory
usn.ubuntu.com/4010-1/Vendor AdvisoryThird Party Advisory
www.openwall.com/lists/oss-security/2019/06/05/3Mailing ListPatchThird Party Advisory
www.openwall.com/lists/oss-security/2019/06/05/4Mailing ListExploit
www.debian.org/security/2019/dsa-4456Vendor AdvisoryThird Party Advisory
seclists.org/bugtraq/2019/Jun/5Mailing ListThird Party Advisory
security.gentoo.org/glsa/201906-01Vendor AdvisoryThird Party Advisory
www.openwall.com/lists/oss-security/2019/06/06/1Mailing ListExploitThird Party Advisory
www.securityfocus.com/bid/108679VDB EntryBroken LinkThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.htmlVendor AdvisoryMailing ListThird Party Advisory

Show all 30 references

seclists.org/fulldisclosure/2019/Jun/16Mailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2019/07/25/6Mailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2019/07/25/7Mailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2019/07/26/4Mailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2021/05/04/7Mailing ListThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149Issue TrackingThird Party Advisory
www.exim.org/static/doc/security/CVE-2019-10149.txtVendor Advisory
packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.htmlExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10149Government ResourceUS Government Resource
ubuntu.com/security/CVE-2019-10149REPORT
www.exim.org/static/doc/security/CVE-2019-10149.txtREPORT
ubuntu.com/security/notices/USN-4010-1Advisory
www.cve.org/CVERecord?id=CVE-2019-10149REPORT
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
security-tracker.debian.org/tracker/CVE-2019-10149Advisory
lists.opensuse.org/archives/…Advisory
bugzilla.suse.com/1136587REPORT
www.suse.com/security/cve/CVE-2019-10149WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities