CVE-2025-32433
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including - but not limited to - Cisco, NetApp, and SUSE.
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12Patch
- github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892fPatch
- github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891Patch
- github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2Vendor Advisory
- openwall.com/lists/oss-security/2025/04/16/2Mailing List
- openwall.com/lists/oss-security/2025/04/18/1Mailing List
- openwall.com/lists/oss-security/2025/04/18/2Mailing List
- openwall.com/lists/oss-security/2025/04/18/6Mailing List
- openwall.com/lists/oss-security/2025/04/19/1Mailing List
- lists.debian.org/debian-lts-announce/2025/04/msg00028.htmlThird Party Advisory
- security.netapp.com/advisory/ntap-20250425-0001/Third Party Advisory
- github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.pyExploit
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 484 days
- CVSS
- 10.0 CRITICAL
- EPSS (30-day exploit probability)
- 98.9% · top 1% of all CVEs
- Weakness
- CWE-306
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.