PT-2023-20889 · China Mobile · China Mobile Oa Mailbox Pc

Yzlcqx · Published 2023-04-10 · Updated 2025-02-11 · CVE-2023-26986

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions China Mobile OA Mailbox PC version 2.9.23

Description An issue in China Mobile OA Mailbox PC allows remote attackers to execute arbitrary commands on a victim host via user interaction with a crafted EML file sent to their OA mailbox.

Recommendations For China Mobile OA Mailbox PC version 2.9.23, consider avoiding the use of crafted EML files until a patch is available. As a temporary workaround, restrict user interaction with potentially malicious EML files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-26986

Affected Products

China Mobile Oa Mailbox Pc

References · 8

• 🔥 https://github.com/YZLCQX/Mailbox-remote-command-execution · Exploit
• https://osv.dev/vulnerability/CVE-2023-26986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26986 · Security Note
• https://t.me/cvenotify/110889 · Telegram Post
• https://gist.github.com/YZLCQX/0da0a438292a5479470c52dad8210462 · Note
• https://t.me/cvenotify/48250 · Telegram Post
• https://t.me/cibsecurity/61777 · Telegram Post
• https://t.me/cvenotify/47889 · Telegram Post