The Raw Message Handler (FORM2RAW.exe) CGI, accessible by default from the WebClient interface, lets unauthenticated users inject mails in the Raw messages queue that can trigger a stack overflow in MDaemon.exe
A successful exploit of a reported security vulnerability could allow an attacker to remotely execute arbitrary code on the ePolicy Orchestrator server. The attack would require network access to the ePolicy Orchestrator server system and reverse engineering of the proprietary communications protocol.
MailEnable is prone to a remotely exploitable buffer overflow vulnerability. This issue occurs in the server's HTTP Header Field Definitions. This condition may be leveraged to overwrite sensitive program control variables, allowing a remote attacker to control execution flow of the server process.