Critical Exim bug bypasses security filters on 1.5 million mail servers

Share:

Censys warns that over 1.5 million Exim mail transfer agent (MTA) instances are unpatched against a critical vulnerability that lets threat actors bypass security filters.

Tracked as CVE-2024-39929 and patched by Exim developers on Wednesday, the security flaw impacts Exim releases up to and including version 4.97.1.

The vulnerability is due to the incorrect parsing of multiline RFC2231 header filenames, which can let remote attackers deliver malicious executable attachments into end users’ mailboxes by circumventing the $mime_filename extension-blocking protection mechanism.

“If a user were to download or run one of these malicious files, the system could be compromised,” Censys warned, adding that “a PoC is available, but no active exploitation is known yet.”

“As of July 10, 2024, Censys observes 1,567,109 publicly exposed Exim servers running a potentially vulnerable version (4.97.1 or earlier), concentrated mostly in the United States, Russia, and Canada,” the company added.

While email recipients will still need to launch the malicious attachment to be affected, the flaw allows threat actors to bypass security checks based on file extensions. This allows them to deliver risky files that are normally blocked, such as executables, into their targets’ mailboxes.

Admins who cannot immediately upgrade Exim are advised to restrict remote access to their servers from the Internet to block incoming exploitation attempts.

Millions of servers exposed online

MTA servers, such as Exim, are often targeted in attacks because they are almost always accessible via the Internet, making them easy to find potential entry points into a target’s network.

Exim is also the default Debian Linux MTA and is the world’s most popular MTA software, based on a mail server survey from earlier this month.

According to the survey, over 59% of the 409,255 mail servers reachable on the Internet during the survey were running Exim, representing just over 241,000 Exim instances.

Also, per a Shodan search, over 3.3 million Exim servers are currently exposed online, most in the United States, followed by Russia and the Netherlands. Censys found 6,540,044 public-facing mail servers online, 4,830,719 (roughly 74%) running Exim

​The National Security Agency (NSA) revealed in May 2020 that the notorious Russian military hacking group Sandworm has been exploiting a critical CVE-2019-10149 Exim flaw (dubbed The Return of the WIZard) since at least August 2019.

More recently, in October, the Exim devs patched three zero-days disclosed through Trend Micro’s Zero Day Initiative (ZDI), one of them (CVE-2023-42115) exposing millions of Internet-exposed Exim servers to pre-auth RCE attacks.

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
3:29 am, Jul 11, 2025
weather icon 18°C
L: 17° | H: 19°
broken clouds
Humidity: 79 %
Pressure: 1021 mb
Wind: 7 mph E
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 60%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:56 am
Sunset: 9:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
17° | 19°°C 0 mm 0% 8 mph 79 % 1021 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
19° | 30°°C 0 mm 0% 10 mph 66 % 1019 mb 0 mm/h
Sun Jul 13 10:00 pm
weather icon
18° | 30°°C 0 mm 0% 7 mph 71 % 1015 mb 0 mm/h
Mon Jul 14 10:00 pm
weather icon
18° | 28°°C 1 mm 100% 15 mph 84 % 1016 mb 0 mm/h
Tue Jul 15 10:00 pm
weather icon
14° | 20°°C 1 mm 100% 14 mph 81 % 1017 mb 0 mm/h
Today 4:00 am
weather icon
17° | 18°°C 0 mm 0% 3 mph 79 % 1021 mb 0 mm/h
Today 7:00 am
weather icon
18° | 19°°C 0 mm 0% 2 mph 75 % 1021 mb 0 mm/h
Today 10:00 am
weather icon
24° | 27°°C 0 mm 0% 2 mph 57 % 1021 mb 0 mm/h
Today 1:00 pm
weather icon
30° | 30°°C 0 mm 0% 3 mph 32 % 1020 mb 0 mm/h
Today 4:00 pm
weather icon
32° | 32°°C 0 mm 0% 4 mph 26 % 1018 mb 0 mm/h
Today 7:00 pm
weather icon
30° | 30°°C 0 mm 0% 6 mph 29 % 1017 mb 0 mm/h
Today 10:00 pm
weather icon
23° | 23°°C 0 mm 0% 8 mph 49 % 1019 mb 0 mm/h
Tomorrow 1:00 am
weather icon
21° | 21°°C 0 mm 0% 5 mph 57 % 1019 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€99,245.34
4.20%
Ethereum(ETH)
€2,529.28
6.20%
Tether(USDT)
€0.85
-0.02%
XRP(XRP)
€2.20
5.67%
Solana(SOL)
€140.46
3.54%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.167882
8.49%
Shiba Inu(SHIB)
€0.000012
9.22%
Pepe(PEPE)
€0.000010
13.30%
Peanut the Squirrel(PNUT)
€0.245548
22.13%
Scroll to Top