CVE-2025-32433Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
Updated under an hour ago ()
Does this affect you?
It affects erlang otp and 23 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Jun 9, 2025; federal agencies had to remediate by Jun 30, 2025. Treat that date as your deadline.
Do this next
Free account, 1 product
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
- CVSS
- 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-306
- Known exploited
- Added to CISA KEV Jun 9, 2025; federal remediation due Jun 30, 2025Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 98.79% (percentile 100)
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Feb 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
erlang otp erlang:otp (from the name) | from OTP-27.0-rc1, < OTP-27.3.3; from OTP-26.0-rc1, < OTP-26.2.5.11; before OTP-25.3.2.20 | CNA record |
erlang erlang/otp erlang:erlang/otp | before 25.3.2.20; from 26.0 before 26.2.5.11; from 27.0 before 27.3.3 | NVD |
cisco confd_basic cisco:confd_basic | before 7.7.19.1; from 8.0.18 before 8.1.16.2; from 8.2 before 8.2.11.1; from 8.3 before 8.3.8.1; from 8.4 before 8.4.4.1 | NVD |
cisco network_services_orchestrator cisco:network_services_orchestrator | before 5.7.19.1; from 5.8 before 6.1.16.2; from 6.2 before 6.2.11.1; from 6.3 before 6.3.8.1; from 6.4 before 6.4.1.1; from 6.4.2 before 6.4.4.1 | NVD |
cisco cloud_native_broadband_network_gateway cisco:cloud_native_broadband_network_gateway | before 2025.03.1 | NVD |
cisco inode_manager cisco:inode_manager | all versions | NVD |
cisco smart_phy cisco:smart_phy | before 25.2 | NVD |
cisco ultra_packet_core cisco:ultra_packet_core | before 2025.03 | NVD |
cisco ultra_services_platform cisco:ultra_services_platform | all versions | NVD |
cisco staros cisco:staros | before 2025.03 | NVD |
cisco optical_site_manager cisco:optical_site_manager | before 25.2.1 | NVD |
cisco ncs_2000_shelf_virtualization_orchestrator_firmware cisco:ncs_2000_shelf_virtualization_orchestrator_firmware | before 25.1.1 | NVD |
cisco enterprise_nfv_infrastructure_software cisco:enterprise_nfv_infrastructure_software | before 4.18 | NVD |
cisco ultra_cloud_core cisco:ultra_cloud_core | before 2025.03.1 | NVD |
cisco rv160w_firmware cisco:rv160w_firmware | all versions | NVD |
cisco rv260_firmware cisco:rv260_firmware | all versions | NVD |
cisco rv160_firmware cisco:rv160_firmware | all versions | NVD |
cisco rv260p_firmware cisco:rv260p_firmware | all versions | NVD |
cisco rv260w_firmware cisco:rv260w_firmware | all versions | NVD |
cisco rv340_firmware cisco:rv340_firmware | all versions | NVD |
cisco rv340w_firmware cisco:rv340w_firmware | all versions | NVD |
cisco rv345_firmware cisco:rv345_firmware | all versions | NVD |
cisco rv345p_firmware cisco:rv345p_firmware | all versions | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
References
- https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2x-refsource-confirm, vendor-advisory
- https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12x-refsource-misc, patch
- https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892fx-refsource-misc, patch
- https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891x-refsource-misc, patch
- http://www.openwall.com/lists/oss-security/2025/04/16/2mailing-list
- http://www.openwall.com/lists/oss-security/2025/04/18/1mailing-list
- http://www.openwall.com/lists/oss-security/2025/04/18/2mailing-list
- http://www.openwall.com/lists/oss-security/2025/04/18/6mailing-list
- http://www.openwall.com/lists/oss-security/2025/04/19/1mailing-list
- https://lists.debian.org/debian-lts-announce/2025/04/msg00028.htmlthird-party-advisory
- https://security.netapp.com/advisory/ntap-20250425-0001/third-party-advisory
- https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.pyexploit
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZythird-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.