Remote Code Execution Vulnerability in Erlang/OTP SSH Server

CVE-2025-32433

What is CVE-2025-32433?

CVE-2025-32433 is a remote code execution vulnerability found in the SSH server component of Erlang/OTP, a set of libraries used for the Erlang programming language. This vulnerability poses a threat by allowing attackers to exploit flaws in the handling of SSH protocol messages, enabling them to execute arbitrary commands on affected systems without needing valid authentication credentials. If left unaddressed, this issue could result in unauthorized access and significant operational disruption for organizations leveraging Erlang/OTP for critical applications.

Technical Details

The vulnerability is tied to specific versions of Erlang/OTP prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. It stems from improper handling of SSH protocol messages, which could allow unauthorized remote code execution (RCE). This flaw potentially exposes systems to unauthorized access by malicious actors. Organizations are advised to implement the patched versions to mitigate the risk or temporarily disable the SSH server or restrict access via firewall rules as a workaround.

Potential impact of CVE-2025-32433

1. Unauthorized System Access: Successful exploitation of the vulnerability allows attackers to execute arbitrary commands, which could lead to full system compromise and manipulation of sensitive data.

2. Operational Disruption: Gaining unauthorized control over systems can disrupt business operations, leading to potential downtime, loss of productivity, and financial impact.

3. Data Breaches: The potential for sensitive information exposure increases, risking data integrity and confidentiality, which could have legal and reputational repercussions for affected organizations.

News Articles

Help Net Security

CVE-2025-32433

PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433) - Help Net Security

There are now public proof-of-concept (PoC) exploits for a maximum-severity vulnerability in the Erlang/OTP SSH server (CVE-2025-32433).

3 days ago

GBHackers News

CVE-2025-32433

PoC Released for Critical Unauthenticated Erlang/OTP RCE Vulnerability

A critical remote code execution (RCE) vulnerability in Erlang/OTP’s SSH implementation (CVE-2025-32433) has now entered active exploit risk.

3 days ago

The Register

CVE-2025-32433

AI models can generate exploit code at lightning speed

The time from vulnerability disclosure to proof-of-concept (PoC) exploit code can now be as short as a few hours, thanks to generative AI models. Matthew Keely, of Platform Security and penetration testing...

3 days ago

More News...

References