CVE-2025-32433
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-32433. We'll provide specific mitigation strategies based on your environment and risk profile.
CVSS Score
V3.1Attack Vector Metrics
Impact Metrics
Description
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Available Exploits
Erlang/OTP SSH - Remote Code Execution
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials.
References:
- https://platformsecurity.com/blog/CVE-2025-32433-poc
- https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12
- https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f
- https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891
- https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2
- https://nvd.nist.gov/vuln/detail/CVE-2025-32433
Related News
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-32433 Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability </l…
Read about a critical vulnerability found in the SSH implementation of Erlang/OTP arising from improper handling of SSH protocol messages. The post CVE-2025-32433: Vulnerability in Erlang/OTP SSH Implementation appeared first on OffSec.
A vulnerability has been identified in Erlang/OTP. A remote attacker could exploit some of this vulnerability to trigger remote code execution on the targeted system. Note: Proof Of Concept exploit code is publicly available for CVE-2025-32433. The vuln…
A critical remote code execution (RCE) vulnerability tracked as CVE-2025-32433 has disclosed. This flaw resides in the Erlang/OTP The post Critical RCE Vulnerability in Erlang/OTP SSH Server Impacts Multiple Cisco Products appeared first on Daily CyberSecurity.
There are now several public proof-of-concept (PoC) exploits for a maximum-severity vulnerability in the Erlang/OTP SSH server (CVE-2025-32433) unveiled last week. “All users running an SSH server based on the Erlang/OTP SSH library are likely to be affected …
Affected Products
Affected Versions:
Known Exploited Vulnerability
This vulnerability is actively being exploited in the wild
Remediation Status
Due Date
Added to KEV
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Product
Ransomware Risk
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
CVE-2025-32433 Tenable's plugins STILL don't check for OTP-27.3.3, 26.2.5.11, or 25.3.2.20! This is a CVSS of 10.0 and you are only checking (plugin 234627) versions 4.15, 5.1, and 5.2. I reported this weeks ago, and the tenable team said they couldn't forward it to their own internal team. Customers pay …
🔥 Top 10 Trending CVEs (12/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-33070](https://nvd.nist.gov/vuln/detail/CVE-2025-33070)** - 📝 Windows Netlogon Elevation of Privilege Vulnerability - 📅 **Published:** 10/06/2025 - 📈 **CVSS:** 8.1 - 🧭 **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - 📣 **Mentions:** 3 - ⚠️ **Priority:** 2 --- **2. …
🔥 Top 10 Trending CVEs (11/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-33053](https://nvd.nist.gov/vuln/detail/CVE-2025-33053)** - 📝 Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability - 📅 **Published:** 10/06/2025 - 📈 **CVSS:** 8.8 - 🛡️ **CISA KEV:** True - 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C - …
🔥 Top 10 Trending CVEs (10/06/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2024-3721](https://nvd.nist.gov/vuln/detail/CVE-2024-3721)** - 📝 A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation …