CVE-2011-1431

CVE-2011-1431 describes a plaintext command injection vulnerability in the STARTTLS implementation of qmail-smtpd, specifically within the netqmail-1.06-tls patch for netqmail 1.06. This flaw allows man-in-the-middle attackers to inject commands into encrypted SMTP sessions by sending cleartext commands that are processed after TLS is established, similar to CVE-2011-0411. With a CVSS score of 6.8, this vulnerability is of medium severity, requiring medium attack complexity (AC:M) but allowing remote exploitation (AV:N) without authentication (Au:N), potentially leading to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.