【資安漏洞預警】桓基科技｜iSherlock

【行政公告】

公告單位	計算機與資訊網路中心
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】桓基科技｜iSherlock - OS Command Injection 【Security Vulnerability Warning】HGiga｜iSherlock - OS Command Injection
公告內容	轉發台灣電腦網路危機處理暨協調中心 TWCERTCC-200-202507-00000007 [內容說明] 【桓基科技｜iSherlock - OS Command Injection】(CVE-2025-7451，CVSS：9.8) 桓基科技開發之iSherlock存在OS Command Injection漏洞，允許未經身分鑑別之遠端攻擊者注入任意作業系統指令並於伺服器上執行。此漏洞已遭開採利用，請盡速更新。 [影響平台] ● 影響產品與版本： Hgiga iSherlock (包含 MailSherlock、SpamSherlock、AuditSherlock)4.5、5.5 ● 影響套件： iSherlock-4.5： iSherlock-maillog-4.5 < 137 iSherlock-smtp-4.5 < 732 iSherlock-5.5： iSherlock-maillog-5.5 < 137 iSherlock-smtp-5.5 < 732 [建議措施] ● 更新套件iSherlock-maillog-4.5至137(含)以後版本 ● 更新套件iSherlock-smtp-4.5至732(含)以後版本 ● 更新套件iSherlock-maillog-5.5至137(含)以後版本 ● 更新套件iSherlock-smtp-5.5至732(含)以後版本 [參考資料] https://www.twcert.org.tw/tw/cp-132-10237-9e0f7-1.html Forwarded by Taiwan Computer Network Crisis Management and Coordination Center TWCERTCC-200-202507-00000007 [Content Description] [HGiga｜iSherlock - OS Command Injection] (CVE-2025-7451, CVSS: 9.8) iSherlock developed by HGiga has an OS Command Injection vulnerability, which allows unauthenticated remote attackers to inject arbitrary operating system commands and execute them on the server. This vulnerability has been exploited, please update as soon as possible. [Affected Platforms] ● Affected Products and Versions: Hgiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) 4.5, 5.5 ● Affected Packages: iSherlock-4.5: iSherlock-maillog-4.5 < 137 iSherlock-smtp-4.5 < 732 iSherlock-5.5: iSherlock-maillog-5.5 < 137 iSherlock-smtp-5.5 < 732 [Suggested Actions] ● Update package iSherlock-maillog-4.5 to version 137 (inclusive) or later ● Update package iSherlock-smtp-4.5 to version 732 (inclusive) or later ● Update package iSherlock-maillog-5.5 to version 137 (inclusive) or later ● Update the package iSherlock-smtp-5.5 to version 732 (inclusive) or later [References] https://www.twcert.org.tw/tw/cp-132-10237-9e0f7-1.html
相關訊息
公告時間	2025/7/15 至 2026/1/15	點閱次數	98