The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Monday added two crucial safety flaws impacting Erlang/Open Telecom Platform (OTP) SSH and Roundcube to its Identified Exploited Vulnerabilities (KEV) catalog, based mostly on proof of lively exploitation.
The vulnerabilities in query are listed beneath –
- CVE-2025-32433 (CVSS rating: 10.0) – A lacking authentication for a crucial perform vulnerability within the Erlang/OTP SSH server that would permit an attacker to execute arbitrary instructions with out legitimate credentials, doubtlessly resulting in unauthenticated distant code execution. (Fastened in April 2025 in variations OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20)
- CVE-2024-42009 (CVSS rating: 9.3) – A cross-site scripting (XSS) vulnerability in RoundCube Webmail that would permit a distant attacker to steal and ship emails of a sufferer by way of a crafted e mail message by making the most of a desanitization problem in program/actions/mail/present.php. (Fastened in August 2024 in variations 1.6.8 and 1.5.8)
There are at the moment no particulars on how the 2 vulnerabilities are exploited within the wild, and by whom. Final month, ESET revealed that the Russia-linked menace actor often called APT28 exploited a number of XSS flaws in Roundcube, Horde, MDaemon, and Zimbra to focus on governmental entities and protection corporations in Japanese Europe. It is not clear if the abuse of CVE-2024-42009 is expounded to this exercise or one thing else.
In accordance with knowledge from Censys, there are 340 uncovered Erlang servers, though it bears noting that not all situations are essentially prone to the flaw. The general public disclosure of CVE-2025-32433 has been rapidly adopted by the launch of a number of proof-of-concept (PoC) exploits for it.
In gentle of lively exploitation, Federal Civilian Government Department (FCEB) businesses are required to use the mandatory fixes by June 30, 2025, for optimum safety.
The event comes as Patchstack flagged an unpatched account takeover vulnerability within the PayU CommercePro plugin for WordPress (CVE-2025-31022, CVSS rating: 9.8) that permits an attacker to grab management of any person of a web site with none authentication.
This will have severe penalties when the attacker is ready to hijack an administrator account, letting them take over the positioning and carry out malicious actions. The vulnerability impacts variations 3.8.5 and earlier than. The plugin has over 5,000 lively installations.
The issue has to do with a perform referred to as “update_cart_data(),” which, in flip, is invoked from an endpoint named “/payu/v1/get-shipping-cost” that checks if a offered e mail tackle exists, and in that case, processes the e-commerce order for checkout.
However as a result of the endpoint checks for a sound token linked to a hard-coded e mail tackle (“commerce.professional@payu[.]in”) and there exists one other REST API to generate an authentication token for a given e mail (“/payu/v1/generate-user-token”), an attacker may exploit this habits to acquire the token equivalent to “commerce.professional@payu[.]in” and ship a request to “/payu/v1/get-shipping-cost” to hijack any account.
Customers are suggested to deactivate and delete the plugin till a patch for the vulnerability is made obtainable.
“It’s crucial to make sure that the unauthenticated REST API endpoints will not be overly permissive and supply extra entry to the customers,” Patchstack mentioned. “Additionally, hard-coding delicate or dynamic info resembling e mail addresses to make use of it for different instances contained in the codebase just isn’t advisable.”
