CVE-2020-15955: Fehcom S/qmail

Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days.

In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the MitM attacker.

Affected products

• Fehcom S/qmail: up to and including 4.0.07

Published 2021-08-17. Last modified 2026-06-17.