PublicCVE
Log inSign up

CVE-2025-32433

CRITICAL10.0
CISA KEVPublic PoCHigh EPSS
JSON exportCreate alert

Description

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

CVSS breakdown

CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Affected products

  • erlang / OTP>= OTP-27.0-rc1, < OTP-27.3.3 – >= OTP-27.0-rc1, < OTP-27.3.3
  • erlang / OTP>= OTP-26.0-rc1, < OTP-26.2.5.11 – >= OTP-26.0-rc1, < OTP-26.2.5.11
  • erlang / OTP< OTP-25.3.2.20 – < OTP-25.3.2.20

Exploits & PoCs

References