What’s Vulnerable › Vulnerabilities

CVE-2025-7451: Hgiga｜iSherlock - OS Command Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-14 · updated 2026-06-17
• Weakness: CWE-78

Description

The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately.

Affected products

• Hgiga iSherlock-maillog-4.5: before 137 — fixed in 137
• Hgiga iSherlock-maillog-5.5: before 137 — fixed in 137
• Hgiga iSherlock-smtp-4.5: before 732 — fixed in 732
• Hgiga iSherlock-smtp-5.5: before 732 — fixed in 732

How to fix

Upgrade to a fixed version: Hgiga iSherlock-maillog-4.5 137; Hgiga iSherlock-maillog-5.5 137; Hgiga iSherlock-smtp-4.5 732; Hgiga iSherlock-smtp-5.5 732. Check the vendor advisory for mitigations.

References

• https://www.twcert.org.tw/en/cp-139-10238-f2bba-2.html
• https://www.twcert.org.tw/tw/cp-132-10237-9e0f7-1.html

Get alerted when CVE-2025-7451 or the next vulnerability affects your stack