CVE-2025-32433

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-32433 10.0

Erlang · Erlang/OTP · Added 2025-06-09 · Published 2025-04-16

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityErlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

VendorErlang

ProductErlang/OTP

Date added2025-06-09

Due date2025-06-30

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-306

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.

NVD: Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-03 03:46 UTC

Searches5

Component defaultdepends on install

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-32433
https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2
https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/
https://github.com/ProDefense/CVE-2025-32433
https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-erlang-otp-ssh-xyZZy.html
https://www.sentinelone.com/vulnerability-database/cve-2025-32433/
https://fidelissecurity.com/vulnerabilities/cve-2025-32433/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433
https://exploit.se/notes/exploits/erlang/otp-ssh-cve-2025-32433

QC notes

warn component_extraction: Component 'SSH connection protocol handler in Erlang/OTP ssh application — fails to enforce authentication state machine, allowing pre-authentication SSH_MSG_CHANNEL_OPEN (type 90) and SSH_MSG_CHANNEL_REQUEST (type 98, request_type='exec') messages to trigger arbitrary command execution without completing SSH_MSG_USERAUTH_SUCCESS' matches or contains product name 'Erlang/OTP' — no specific component identified

Hunting hypothesis agent

Hunt Erlang/OTP sshd (banner 'SSH-2.0-Erlang/OTP') spawning child shells without a preceding userauth_success event, indicating pre-auth channel_request command injection enabling RCE.

Research details

ComponentSSH connection protocol handler in Erlang/OTP ssh application — fails to enforce authentication state machine, allowing pre-authentication SSH_MSG_CHANNEL_OPEN (type 90) and SSH_MSG_CHANNEL_REQUEST (type 98, request_type='exec') messages to trigger arbitrary command execution without completing SSH_MSG_USERAUTH_SUCCESS

PreconditionsNetwork access (TCP) to an Erlang/OTP SSH server running a vulnerable version: OTP-27.3.2 or earlier, OTP-26.2.5.10 or earlier, OTP-25.3.2.19 or earlier, or any version from OTP-17.0 and older. The SSH server must be enabled and listening on an exposed port (commonly 22, 2222, or non-standard). No authentication credentials are required. The attacker completes the SSH transport handshake (key exchange, algorithm negotiation), then sends SSH_MSG_CHANNEL_OPEN to open a session channel followed by SSH_MSG_CHANNEL_REQUEST with request_type='exec' and a payload containing arbitrary commands. The server processes these connection protocol messages (codes >= 80) without verifying authentication state, executing commands as the sshd running user. The SSH server banner (e.g. 'SSH-2.0-Erlang/OTP-25') reveals the version for targeted exploitation. Affects any product embedding the Erlang/OTP SSH library including Cisco ConfD, NSO, StarOS, RabbitMQ, and CouchDB. agent

DeliveryThe attacker establishes a TCP connection to the target's Erlang/OTP SSH port and completes the SSH transport handshake (key exchange, algorithm negotiation, SSH_MSG_NEWKEYS). Before authenticating, the attacker sends SSH_MSG_CHANNEL_OPEN (type 90) to open a session channel, followed by SSH_MSG_CHANNEL_REQUEST (type 98) with request_type='exec' and a payload containing arbitrary shell commands. The vulnerable server processes these connection protocol messages (codes >= 80) without verifying that SSH_MSG_USERAUTH_SUCCESS has been received, executing the commands as the sshd process user. In-the-wild payloads include reverse shells via bash interactive mode with /dev/tcp redirection to attacker-controlled IPs (e.g. 146.103.40.203:6667) and DNS-based OAST callbacks to randomised subdomains under dns.outbound.watchtowr.com.

Public PoCyes

PoC URLs https://github.com/ProDefense/CVE-2025-32433
https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
https://github.com/joshuavanderpoll/cve-2025-32433
https://github.com/NiteeshPujari/CVE-2025-32433-PoC
https://github.com/vulhub/vulhub/tree/master/erlang/CVE-2025-32433 Third-party repos; verify before use.

Advisoryhttps://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2

Exploit notesCVSS attack complexity: LOW. Exploitation requires only network access to an Erlang/OTP SSH port with no authentication. Multiple public PoCs exist: ProDefense/CVE-2025-32433 (143 stars) provides a Python exploit and Docker-based vulnerable server; omer-efe-curkus PoC adds vulnerability check, command execution, and reverse shell modes. The exploit sends SSH_MSG_CHANNEL_OPEN (type 90) followed by SSH_MSG_CHANNEL_REQUEST (type 98, request_type='exec') before authentication completes. First PoC was generated with ChatGPT within hours of disclosure. Active exploitation observed in the wild since May 1, 2025, with 70% of Palo Alto Unit 42 detections originating from OT network firewalls. ITW payloads include reverse shells via bash /dev/tcp and DNS callbacks to dns.outbound.watchtowr.com for OAST. The vulnerability affects the SSH connection state machine across all Erlang/OTP versions from OTP-17.0 through the unpatched release branches.

SummaryCVE-2025-32433 is a critical (CVSS 10.0) pre-authentication remote code execution vulnerability in the Erlang/OTP SSH server caused by improper enforcement of the SSH authentication state machine. The server processes SSH connection protocol messages (SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_REQUEST with exec payloads) before authentication completes, allowing an unauthenticated attacker to execute arbitrary commands as the sshd user. Multiple public PoC exploits are available, and active exploitation has been observed in the wild since May 2025, with 70% of detections targeting operational technology (OT) networks. Affected products include Cisco ConfD, NSO, StarOS, and any application embedding Erlang/OTP's SSH library. Patched in OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20.

Tia coverage

First reported2026-07-11

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

the-gentlemen-ransomware-storm-2697-fastest-growing-raas-of-2026

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.