Pierluigi Paganini June 10, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the descriptions for these flaws:

• CVE-2025-32433 (CVSS score of 10) Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability 
• CVE-2024-42009 (CVSS score of 9.3) RoundCube Webmail Cross-Site Scripting Vulnerability 

The CVE-2025-32433 flaw is a critical issue that impacts older versions of Erlang/OTP, a toolkit used with the Erlang programming language. If you’re running a version before OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20, your system could be vulnerable to remote code execution (RCE) through its built-in SSH server. This means an attacker could potentially run code on target system without logging in or needing any credentials. The issue has been fixed in the mentioned versions. Until you can update, a quick fix is to either turn off the SSH server or block access using a firewall.

Sonar’s Vulnerability Research Team discovered the CVE-2024-42009 flaw in the Roundcube webmail software in August 2024.

The issue is a critical Cross-Site Scripting (XSS) vulnerability, the researchers pointed out that Roundcube is included by default in the server hosting panel cPanel, which has millions of installations worldwide.

An attacker can trigger the vulnerability to execute arbitrary JavaScript in the victim’s browser when they view a malicious email, potentially leading to the theft of emails, contacts, passwords, and unauthorized email sending.

Sonar explained that government employees’ emails are a valuable target for APT groups carrying out cyber espionage campaigns. In October 2023, ESET Research revealed that a similar vulnerability was exploited by the APT group Winter Vivern to target European government entities.

No user interaction is required to successfully exploit the vulnerability CVE-2024-42009.

“These allow an unauthenticated attacker to steal emails and contacts, as well as send emails from a victim’s account. All the victim user has to do is view a malicious email in Roundcube.” reads the report published by Sonar. “Attackers can gain a persistent foothold in the victim’s browser across restarts, allowing them to exfiltrate emails continuously or steal the victim’s password the next time it is entered.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by June 30, 2025.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)