What is CVE-2012-10046?

CVE-2012-10046 is a vulnerability in Esva-Project E-Mail Security Virtual Appliance, classified under OS Command Injection. Published 2025-08-08.

Is CVE-2012-10046 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Esva-Project E-Mail Security Virtual Appliance

CVE-2012-10046

The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and results in full command execution on the underlying system.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.029 (85.6th percentile) — read the EPSS interpretation.

Affected products

Esva-project E-mail Security Virtual Appliance — versions ESVA_2057

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

References

disclosure@vulncheck.com (product)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2012-10046?: CVE-2012-10046 is a vulnerability in Esva-Project E-Mail Security Virtual Appliance, classified under OS Command Injection. Published 2025-08-08.
Is CVE-2012-10046 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.