CVE-2022-37030: Grommunio Gromox

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox group to have the PAM stack execute arbitrary code upon loading the Gromox PAM module.

Affected products

• Grommunio Gromox: from 0.5, before 1.28 (fixed in 1.28)

Published 2022-08-04. Last modified 2026-06-17.