CVE-2008-1992: Acidcat CMS 3.4.1 does not properly restrict access to (1) default_mail_aspemail.asp, (2) default_mail_cdos...

Security readout for executives and security teams

Acidcat CMS 3.4.1 exposes mail-sending ASP pages without proper access restriction. An unauthenticated remote attacker could use them to relay email and alter sender and recipient fields, creating spam, phishing, and domain reputation risk for any organization still running this legacy CMS. Exposure is likely limited to legacy Acidcat CMS 3.4.1 deployments, especially internet-facing IIS/ASP sites where the listed default_mail ASP files remain reachable. The bundle does not identify affected CPEs or later versions. Treat this as a legacy exposure and reputation risk rather than a confirmed emergency. Prioritize remediation if Acidcat CMS 3.4.1 is internet-facing or can send external email. Mitigation focus: Inventory for Acidcat CMS 3.4.1 and the listed mail ASP files.; Remove or restrict public access to unused default_mail ASP scripts.; Disable unauthenticated mail relay functionality where business use is not required..

Prepared

Jun 28, 2026, 19:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.