CVE-2014-3556

CVE-2014-3556 describes a plaintext command injection vulnerability in the STARTTLS implementation of the Nginx SMTP proxy (versions 1.5.x and 1.6.x before 1.6.1, and 1.7.x before 1.7.4). This flaw allows a man-in-the-middle attacker to insert cleartext commands into an encrypted SMTP session by exploiting improper I/O buffering. The vulnerability carries a CVSS score of 6.8, indicating a medium severity risk with a network attack vector, medium attack complexity, and potential for partial confidentiality, integrity, and availability impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.