State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-59689 | Command Injection in Libraesva Email Security Gateway Exploited in the Wild CVE-2025-59689 is a command injection flaw (CWE-77) in Libraesva Email Security Gateway versions 4.5 through 5.5.x before 5.5.7. It is triggered when the gateway processes a crafted compressed email attachment; per the CVSS vector, no privileges are required but user interaction is involved, and the injection lets an attacker run arbitrary commands with impact that extends beyond the affected component (scope change). Any organization running an affected Libraesva ESG release is in scope, with email security gateways typically sitting in the mail flow and handling untrusted inbound attachments. The flaw is being actively exploited, with public reports attributing exploitation to state-sponsored actors, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-09-29. Do: Upgrade to the fixed release for your deployed line: 5.5.7, 5.4.8, 5.2.31, 5.1.20, or 5.0.31. Because the flaw is actively exploited, including by nation-state actors, review gateway logs and compressed-attachment handling for signs of compromise after patching; organizations subject to BOD 22-01 must apply vendor mitigations or discontinue use of the product. | 6.1 | 2% | KEV |
| nichelikely on the order of thousands of appliance deployments worldwide (exact count unknown) |
Full article330 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 24, 2025Vulnerability / Email Security
Libraesva has released a security update to address a vulnerability in its Email Security Gateway (ESG) solution that it said has been exploited by state-sponsored threat actors.
The vulnerability, tracked as CVE-2025-59689, carries a CVSS score of 6.1, indicating medium severity.
"Libraesva ESG is affected by a command injection flaw that can be triggered by a malicious email containing a specially crafted compressed attachment, allowing potential execution of arbitrary commands as a non-privileged user," Libraesva said in an advisory.
"This occurs due to an improper sanitization during the removal of active code from files contained in some compressed archive formats."
In a hypothetical attack scenario, an attacker could exploit the flaw by sending an email containing a specially crafted compressed archive, allowing a threat actor to leverage the application's improper sanitization logic to ultimately execute arbitrary shell commands.
The shortcoming affects Libraesva ESG versions 4.5 through 5.5.x before 5.5.7, with fixes released in 5.0.31, 5.1.20, 5.2.31, 5.3.16, 5.4.8, and 5.5.7. Libraesva noted in the alert that versions below 5.0 have reached end-of-support and must be manually upgraded to a supported release.
The Italian email security company also acknowledged that it has identified one confirmed incident of abuse, and that the threat actor is "believed to be a foreign hostile state entity." It did not share any further details on the nature of the activity, or who may be behind it.
"The single‑appliance focus underscores the precision of the threat actor (believed to be a foreign hostile state) and highlights the importance of rapid, comprehensive patch deployment," Libraesva said, adding it deployed a fix within 17 hours of flagging the abuse.
In light of active exploitation, it's essential that users of the ESG software update their instances to the latest version as soon as possible to mitigate potential threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/09/state-sponsored-hackers-exploiting.html