Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

vpopmail 5.4.14/5.4.15 allows login with blank password

CVE-2006-2346 · published 20 years ago
Summary

Versions 5.4.14 and 5.4.15 of the vpopmail mail software can be set to store passwords in plain text. If that setting is on, an attacker can log in to any account that does not have a plain‑text password by using an empty password, giving them the ability to send or retrieve email. Update to a newer release or turn off the plain‑text password option and require a real password for each account.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
inter7 vpopmail_\(vchkpw\) 5.4.14
5.4.15
cpe:2.3:a:inter7:vpopmail_\(vchkpw\):5.4.14:*:*:*:*:*:*:*
Original advisory text
vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to (1) SMTP...
vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to (1) SMTP AUTH or (2) APOP.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published12 May 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-2346 · NVD
Track software like this
Free during beta