{"vulnerability": "CVE-2019-7214", "sightings": [{"uuid": "4ffe065a-62b5-448a-a91e-9a59e0a71d23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "68839378-1294-43d1-8a55-5ed8826c2b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:17.000000Z"}, {"uuid": "f50db9b6-e67f-4761-8c49-f26bd0f72b43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:58.000000Z"}, {"uuid": "dfcf3806-3896-4c90-b5f2-e0d02fe6a061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/smartermail_rce.rb", "content": "", "creation_timestamp": "2023-07-10T23:19:51.000000Z"}, {"uuid": "c5107108-f58e-4e5b-ad5b-1a09ccc287e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "published-proof-of-concept", "source": "Telegram/rj2ObYAKKGRmZTk9PYQyTU6MfpOJvGLJV8P7iFc-4Y7ni0w", "content": "", "creation_timestamp": "2025-06-03T21:00:05.000000Z"}, {"uuid": "85c8c0dc-6484-44fb-af33-5de99f52f7c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "published-proof-of-concept", "source": "Telegram/DSUpJzd535KWvozjCvixS0aCLxmEfW4QzhCQOssR_q3Zo9k", "content": "", "creation_timestamp": "2025-03-07T10:00:06.000000Z"}, {"uuid": "e47f8053-bf5f-4729-b65d-45d709674686", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/smartermail_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Soroush Dalili\", \"1F98D\", \"Ismail E. Dawoodjee\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in the SmarterTools SmarterMail\\n          software for version numbers <= 16.x or for build numbers < 6985.\\n          The vulnerable versions and builds expose three .NET remoting endpoints\\n          on port 17001, namely /Servers, /Mail and /Spool. For example, a\\n          typical installation of SmarterMail Build 6970 will have the /Servers\\n          endpoint exposed to the public at tcp://0.0.0.0:17001/Servers, where\\n          serialized .NET commands can be sent through a TCP socket connection.\\n\\n          The three endpoints perform deserialization of untrusted data\\n          (CVE-2019-7214), allowing an attacker to send arbitrary commands\\n          to be deserialized and executed. This module exploits this vulnerability\\n          to perform .NET deserialization attacks, allowing remote code execution\\n          for any unauthenticated user under the context of the SYSTEM account.\\n          Successful exploitation results in full administrative control of the\\n          target server under the NT AUTHORITY\\\\SYSTEM account.\\n\\n          This vulnerability was patched in Build 6985, where the 17001 port is\\n          no longer publicly accessible, although it can be accessible locally\\n          at 127.0.0.1:17001. Hence, this would still allow for a privilege\\n          escalation vector if the server is compromised as a low-privileged user.\", \"disclosure_date\": \"2019-04-17\", \"fullname\": \"exploit/windows/http/smartermail_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"SmarterTools SmarterMail less than build 6985 - .NET Deserialization Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/smartermail_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/smartermail_rce\", \"references\": [\"CVE-2019-7214\", \"EDB-49216\", \"URL-https://research.nccgroup.com/2019/04/16/technical-advisory-multiple-vulnerabilities-in-smartermail/\"], \"rport\": 9998, \"session_types\": false, \"targets\": [\"Windows Command\", \"x86/x64 Windows CmdStager\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:59.750113Z"}, {"uuid": "21843cb7-ada3-4359-b34c-47dd39487864", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "published-proof-of-concept", "source": "Telegram/jal93TFIpDSXHuxPAVoXUYLkFRmAEbvfXme4VCIXcHlI9Tk", "content": "", "creation_timestamp": "2026-09-18T14:00:04.509373Z"}, {"uuid": "91923490-4596-4a32-a103-2f253807f914", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-7214", "type": "published-proof-of-concept", "source": "Telegram/jal93TFIpDSXHuxPAVoXUYLkFRmAEbvfXme4VCIXcHlI9Tk", "content": "", "creation_timestamp": "2026-09-19T00:00:34.344350Z"}]}