CVE-2025-2975 describes a problematic cross-site scripting (XSS) vulnerability discovered in GFI KerioConnect versions 10.0.6. This flaw allows attackers to inject malicious scripts via manipulation of the Settings/Email/Signature/EditHtmlSource component. Affected users should upgrade to version 10.0.7 to mitigate this risk. The vulnerability has been publicly disclosed.
Successful exploitation of CVE-2025-2975 enables an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to a variety of malicious outcomes, including session hijacking, phishing attacks, and defacement of the KerioConnect web interface. An attacker could potentially steal sensitive information, such as email credentials or contact details, or redirect users to malicious websites. The impact is amplified if the KerioConnect server is used to manage email for multiple users, as a single successful attack could compromise numerous accounts.
This vulnerability has been publicly disclosed, increasing the likelihood of exploitation. While the CVSS score is LOW, the ease of exploitation and potential impact warrant immediate attention. No known active campaigns have been reported at this time, but the public availability of the vulnerability makes it a prime target for opportunistic attackers. The vendor's lack of response to the disclosure is concerning.
Exploit Status
EPSS
0.14% (33% percentile)
CISA SSVC
The primary mitigation for CVE-2025-2975 is to upgrade KerioConnect to version 10.0.7 or later, which contains the fix. If immediate upgrading is not possible, consider restricting access to the Settings/Email/Signature/EditHtmlSource component through network firewalls or access control lists. While not a complete solution, input validation and output encoding on the server-side can help reduce the attack surface. Monitor KerioConnect logs for suspicious activity, particularly requests targeting the vulnerable component.
Update KerioConnect to a version later than 10.0.6 that fixes the XSS vulnerability. Consult the GFI vendor website for the latest version and update instructions. If no version is available, disable or restrict access to the 'EditHtmlSource' function until a solution is published.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-2975 is a cross-site scripting vulnerability in KerioConnect versions 10.0.6, allowing attackers to inject malicious scripts via the email signature editor. It has a LOW severity rating.
If you are running KerioConnect version 10.0.6, you are potentially affected by this vulnerability. Upgrade to 10.0.7 to resolve the issue.
The recommended fix is to upgrade KerioConnect to version 10.0.7 or later. As a temporary workaround, restrict access to the vulnerable component.
While no active campaigns have been confirmed, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Refer to the KerioConnect website for the official advisory and release notes for version 10.0.7.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.