CVE-2023-53949

AspEmail 5.6.0.2 Local Privilege Escalation via Binary Permission Vulnerability

State: Published
Severity: 8.5 High
Published: Dec 19, 2025
Updated: May 14, 2026
Reserved: Dec 16, 2025

Description

AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service. Attackers can exploit full write permissions in the BIN directory to replace the service executable and gain elevated system access.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
AspEmailAspemail	5.6.0.2 and earlierAffected

References

ExploitDB-51380exploit
Official Product Homepageproduct
VulnCheck Advisory: AspEmail 5.6.0.2 Local Privilege Escalation via Binary Permission Vulnerabilitythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.