CISA Adds Erlang SSH and Roundcube Flaws to Known Exploited Vulnerabilities Catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-42009 | Cross-Site Scripting in Roundcube Webmail Lets Attackers Steal Emails CVE-2024-42009 is a cross-site scripting (CWE-79) vulnerability in Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7, caused by a desanitization issue in message_body() in program/actions/mail/show.php. An attacker sends a specially crafted email, and when the victim opens it in the Roundcube interface, injected script runs in the context of the victim's webmail session (no privileges are required, but user interaction is needed, per the CVSS UI:R vector). Successful exploitation lets the attacker steal the victim's emails and send messages as the victim, and related reporting notes that, chained with the companion flaw CVE-2024-42008, attackers can compromise email accounts and passwords. Any organization or provider self-hosting an affected Roundcube version is exposed, including universities, hosting providers, enterprises, and government mail systems. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-06-09, EPSS is 82.9% (100th percentile), and recent headlines describe suspected China-aligned espionage activity using Roundcube exploit chains against universities. Do: Upgrade Roundcube to a point release newer than 1.6.7 on the 1.6.x line or newer than 1.5.7 on the 1.5.x line (the latest vendor release of each branch), per vendor instructions; organizations under BOD 22-01 must apply the required mitigations by the KEV due date or discontinue use. Also patch the companion issue CVE-2024-42008 to prevent chained account compromise. Review webmail access logs for suspicious requests to the mail show handler, check sent-mail folders for messages sent unexpectedly as users, and rotate sessions/credentials for potentially targeted accounts. | 9.3 | 83% | KEV |
| massroughly millions of users across tens of thousands of self-hosted instances (public scans show tens of thousands of internet-exposed Roundcube servers) | |
| CVE-2025-31022 | Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU I Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through < 3.8.8. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2025-32433 | Unauthenticated RCE in Erlang/OTP SSH Server CVE-2025-32433 is a missing-authentication flaw (CWE-306) in the SSH server shipped with Erlang/OTP, the runtime and libraries of the Erlang programming language. An unauthenticated attacker can send specially crafted SSH protocol messages to a vulnerable Erlang/OTP SSH daemon before authentication and trigger remote code execution. Successful exploitation yields arbitrary command execution on the host with the privileges of the SSH service, and the CVSS scope change (S:C) indicates compromise can cascade to resources beyond the vulnerable component. Affected are any systems exposing the Erlang/OTP SSH server, including standalone Erlang deployments, Debian-packaged Erlang, and Cisco products that embed Erlang/OTP (e.g., Network Services Orchestrator, ConfD Basic, Ultra Packet Core). Exploitation is confirmed in the wild: a public proof-of-concept exists, the bug was added to CISA KEV on 2025-06-09, and researchers report a surge in exploitation attempts, with roughly 70% of observed attacks targeting OT firewalls. Do: Upgrade Erlang/OTP to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 depending on the release branch, and apply the corresponding updates from Cisco and Debian for embedded/packaged Erlang. Until patched, disable the Erlang SSH daemon or restrict access to it with firewall rules, prioritizing internet-exposed hosts and OT firewall devices where ~70% of observed attacks have landed. Federal agencies must apply mitigations per vendor instructions under the KEV/BOD 22-01 requirements. | 10.0 | 99% | KEV PoC |
| largetens of thousands of internet-exposed Erlang/OTP SSH servers, plus an unknown additional embedded installed base in telecom/network equipment (Cisco NSO,… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | payu.in | d token linked to a hard-coded email address ("commerce.pro@payu[.]in") and there exists another REST API to generate an authen |
| ipv4 | 25.3.2.20 | n April 2025 in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20) CVE-2024-42009 (CVSS score: 9.3) - A cross-site scripting |
| ipv4 | 26.2.5.11 | execution. (Fixed in April 2025 in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20) CVE-2024-42009 (CVSS score: 9.3) - A cr |
Full article580 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 10, 2025Vulnerability / Cyber Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added two critical security flaws impacting Erlang/Open Telecom Platform (OTP) SSH and Roundcube to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerabilities in question are listed below -
- CVE-2025-32433 (CVSS score: 10.0) - A missing authentication for a critical function vulnerability in the Erlang/OTP SSH server that could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution. (Fixed in April 2025 in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20)
- CVE-2024-42009 (CVSS score: 9.3) - A cross-site scripting (XSS) vulnerability in RoundCube Webmail that could allow a remote attacker to steal and send emails of a victim via a crafted email message by taking advantage of a desanitization issue in program/actions/mail/show.php. (Fixed in August 2024 in versions 1.6.8 and 1.5.8)
There are currently no details on how the two vulnerabilities are exploited in the wild, and by whom. Last month, ESET revealed that the Russia-linked threat actor known as APT28 exploited several XSS flaws in Roundcube, Horde, MDaemon, and Zimbra to target governmental entities and defense companies in Eastern Europe. It's not clear if the abuse of CVE-2024-42009 is related to this activity or something else.
According to data from Censys, there are 340 exposed Erlang servers, although it bears noting that not all instances are necessarily susceptible to the flaw. The public disclosure of CVE-2025-32433 has been quickly followed by the release of several proof-of-concept (PoC) exploits for it.
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary fixes by June 30, 2025, for optimal protection.
The development comes as Patchstack flagged an unpatched account takeover vulnerability in the PayU CommercePro plugin for WordPress (CVE-2025-31022, CVSS score: 9.8) that enables an attacker to seize control of any user of a site without any authentication.
This can have serious consequences when the attacker is able to hijack an administrator account, permitting them to take over the site and perform malicious actions. The vulnerability affects versions 3.8.5 and before. The plugin has over 5,000 active installations.
The problem has to do with a function called "update_cart_data()," which, in turn, is invoked from an endpoint named "/payu/v1/get-shipping-cost" that checks if a provided email address exists, and if so, processes the e-commerce order for checkout.
But because the endpoint checks for a valid token linked to a hard-coded email address ("commerce.pro@payu[.]in") and there exists another REST API to generate an authentication token for a given email ("/payu/v1/generate-user-token"), an attacker could exploit this behavior to obtain the token corresponding to "commerce.pro@payu[.]in" and send a request to "/payu/v1/get-shipping-cost" to hijack any account.
Users are advised to deactivate and delete the plugin until a patch for the vulnerability is made available.
"It is necessary to ensure that the unauthenticated REST API endpoints are not overly permissive and provide more access to the users," Patchstack said. "Also, hard-coding sensitive or dynamic information such as email addresses to use it for other cases inside the codebase is not recommended."
Over 2 Million Roundcube Webmail Instances Found Online
Attack surface management platform Censys has revealed that it found 2,473,116 exposed Roundcube Webmail instances online, with a majority of them located in Europe and North America.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/06/cisa-adds-erlang-ssh-and-roundcube.html