U.S. CISA adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities catalog

CVE-2024-42009 is a cross-site scripting (CWE-79) vulnerability in Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7, caused by a desanitization issue in message_body() in program/actions/mail/show.php. An attacker sends a specially crafted email, and when the victim opens it in the Roundcube interface, injected script runs in the context of the victim's webmail session (no privileges are required, but user interaction is needed, per the CVSS UI:R vector). Successful exploitation lets the attacker steal the victim's emails and send messages as the victim, and related reporting notes that, chained with the companion flaw CVE-2024-42008, attackers can compromise email accounts and passwords. Any organization or provider self-hosting an affected Roundcube version is exposed, including universities, hosting providers, enterprises, and government mail systems. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-06-09, EPSS is 82.9% (100th percentile), and recent headlines describe suspected China-aligned espionage activity using Roundcube exploit chains against universities.

Do: Upgrade Roundcube to a point release newer than 1.6.7 on the 1.6.x line or newer than 1.5.7 on the 1.5.x line (the latest vendor release of each branch), per vendor instructions; organizations under BOD 22-01 must apply the required mitigations by the KEV due date or discontinue use. Also patch the companion issue CVE-2024-42008 to prevent chained account compromise. Review webmail access logs for suspicious requests to the mail show handler, check sent-mail folders for messages sent unexpectedly as users, and rotate sessions/credentials for potentially targeted accounts.

CVE-2025-32433 is a missing-authentication flaw (CWE-306) in the SSH server shipped with Erlang/OTP, the runtime and libraries of the Erlang programming language. An unauthenticated attacker can send specially crafted SSH protocol messages to a vulnerable Erlang/OTP SSH daemon before authentication and trigger remote code execution. Successful exploitation yields arbitrary command execution on the host with the privileges of the SSH service, and the CVSS scope change (S:C) indicates compromise can cascade to resources beyond the vulnerable component. Affected are any systems exposing the Erlang/OTP SSH server, including standalone Erlang deployments, Debian-packaged Erlang, and Cisco products that embed Erlang/OTP (e.g., Network Services Orchestrator, ConfD Basic, Ultra Packet Core). Exploitation is confirmed in the wild: a public proof-of-concept exists, the bug was added to CISA KEV on 2025-06-09, and researchers report a surge in exploitation attempts, with roughly 70% of observed attacks targeting OT firewalls.

Do: Upgrade Erlang/OTP to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 depending on the release branch, and apply the corresponding updates from Cisco and Debian for embedded/packaged Erlang. Until patched, disable the Erlang SSH daemon or restrict access to it with firewall rules, prioritizing internet-exposed hosts and OT firewall devices where ~70% of observed attacks have landed. Federal agencies must apply mitigations per vendor instructions under the KEV/BOD 22-01 requirements.