CVE-2025-32433
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Description
CVE-2025-32433 is a maximum-severity unauthenticated remote code execution vulnerability in the Erlang/OTP SSH server implementation. The flaw in SSH protocol message handling allows a malicious actor to execute arbitrary commands on affected systems without valid credentials, earning a perfect CVSS v3.1 base score of 10.0 (CRITICAL). The vulnerability requires no authentication, no user interaction, and has low attack complexity while affecting resources beyond the vulnerable component. CISA has added CVE-2025-32433 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 50.31% at the 98th percentile confirms widespread exploitation activity. The vulnerability impacts Erlang/OTP versions prior to 27.3.3, 26.2.5.11, and 25.3.2.20, and extends to numerous Cisco products that embed Erlang/OTP SSH functionality.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| erlang | erlang\/otp | < 25.3.2.20; >= 26.0, < 26.2.5.11; >= 27.0, < 27.3.3 |
| cisco | confd basic | < 7.7.19.1; >= 8.0.18, < 8.1.16.2; >= 8.2, < 8.2.11.1; >= 8.3, < 8.3.8.1; >= 8.4, < 8.4.4.1 |
| cisco | network services orchestrator | < 5.7.19.1; >= 5.8, < 6.1.16.2; >= 6.2, < 6.2.11.1; >= 6.3, < 6.3.8.1; >= 6.4, < 6.4.1.1; >= 6.4.2, < 6.4.4.1 |
| cisco | cloud native broadband network gateway | < 2025.03.1 |
| cisco | inode manager | - |
| cisco | smart phy | < 25.2 |
| cisco | ultra packet core | < 2025.03 |
| cisco | ultra services platform | - |
| cisco | staros | < 2025.03 |
| cisco | optical site manager | < 25.2.1 |
| cisco | ncs 2000 shelf virtualization orchestrator firmware | < 25.1.1 |
| cisco | enterprise nfv infrastructure software | < 4.18 |
| cisco | ultra cloud core | < 2025.03.1 |
| cisco | rv160w firmware | - |
| cisco | rv260 firmware | - |
| cisco | rv160 firmware | - |
| cisco | rv260p firmware | - |
| cisco | rv260w firmware | - |
| cisco | rv340 firmware | - |
| cisco | rv340w firmware | - |
References
- https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12(Patch)
- https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f(Patch)
- https://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891(Patch)
- https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2(Vendor Advisory)
- http://www.openwall.com/lists/oss-security/2025/04/16/2(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/04/18/1(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/04/18/2(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/04/18/6(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/04/19/1(Mailing List)
- https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20250425-0001/(Third Party Advisory)
- https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.py(Exploit)
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
The missing authentication weakness in CVE-2025-32433 exists in the Erlang/OTP SSH server's protocol message handling. The SSH server fails to enforce authentication for certain critical operations during the SSH protocol handshake, allowing a remote attacker to execute commands on the server without providing any valid credentials. This represents a fundamental authentication bypass in the SSH protocol implementation.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
The impact of CVE-2025-32433 is the most severe possible, with Confidentiality (High), Integrity (High), and Availability (High) all fully compromised, and the Scope Changed (S:C) to affect resources beyond the vulnerable SSH service. The perfect CVSS score of 10.0 reflects that the vulnerability is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N). Any system running an Erlang/OTP SSH server is fully compromisable by a remote unauthenticated attacker. The EPSS score of 50.3% at the 98th percentile confirms extensive exploitation. The vulnerability is particularly impactful because Erlang/OTP SSH is embedded in numerous critical infrastructure products from Cisco and other vendors, including network services orchestrators, cloud infrastructure components, and telecommunications equipment, amplifying the blast radius well beyond standalone Erlang applications.
Exploit Maturity
CVE-2025-32433 has very high exploit maturity with confirmed active exploitation and a maximum CVSS score of 10.0. Public exploit code is available on GitHub (ProDefense), providing a working proof-of-concept for unauthenticated remote code execution. CISA has added the vulnerability to the Known Exploited Vulnerabilities catalog, and the EPSS score of 50.31% at the 98th percentile confirms widespread exploitation activity. The vulnerability disclosure through the Erlang/OTP GitHub Security Advisory and subsequent patches across three OTP branches indicate the severity recognized by the maintainers. Cisco has issued its own security advisory for affected products, confirming the wide-reaching impact across networking infrastructure.
Remediation
-
Update Erlang/OTP immediately to patched versions: OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20. Apply the specific patches from the Erlang/OTP repository. For Cisco products, follow the remediation guidance in the Cisco Security Advisory.
-
Disable SSH services on any Erlang/OTP application where SSH is not strictly required. If SSH must remain enabled, restrict access through firewall rules to allow connections only from trusted administrative IP addresses and management networks.
-
Identify all systems running Erlang/OTP SSH in your environment, including embedded use in Cisco ConfD, NSO, Ultra Cloud Core, and other networking infrastructure products. Many organizations may not realize they are running Erlang SSH servers within their Cisco infrastructure.
-
Deploy network-level monitoring for exploitation attempts targeting SSH services on non-standard ports where Erlang/OTP applications may be listening. Monitor for the specific SSH protocol message manipulation patterns associated with this vulnerability.
-
Implement network segmentation to isolate systems running Erlang/OTP SSH services from general network access. Apply the principle of least privilege to ensure only authorized management traffic can reach these services, and consider deploying a bastion host or VPN gateway as an access control point.
Technical Details
CVE-2025-32433 is an unauthenticated remote code execution vulnerability in the Erlang/OTP SSH server implementation, caused by missing authentication for critical functions in the SSH protocol message handling. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H represents the maximum possible score: network-accessible (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), Changed scope (S:C), with high impact across all CIA dimensions. The vulnerability exists in how the Erlang/OTP SSH server processes SSH protocol messages during the connection setup phase. The SSH protocol defines a strict sequence of messages that should occur during authentication, but the Erlang/OTP implementation fails to properly enforce this sequence, allowing an attacker to send SSH channel requests and execute commands before completing the authentication handshake. This means any SSH message that should only be processed after successful authentication can be sent pre-authentication, giving the attacker the same level of access as a fully authenticated user. The commands execute with the privileges of the Erlang/OTP process, which in many deployments runs as root. The vulnerability affects all Erlang/OTP versions prior to the patches and extends to any application or product that embeds the Erlang SSH library, including numerous Cisco products such as ConfD, NSO, and various infrastructure platforms.
Frequently Asked Questions
Is CVE-2025-32433 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2025-32433 to the Known Exploited Vulnerabilities catalog. The EPSS score of 50.31% at the 98th percentile confirms widespread exploitation, and public exploit code is available on GitHub.
What products are affected by CVE-2025-32433?
All Erlang/OTP versions prior to 27.3.3, 26.2.5.11, and 25.3.2.20 are affected. This extends to numerous Cisco products including ConfD, Network Services Orchestrator (NSO), Ultra Cloud Core, StarOS, and various RV-series router firmware. Any product embedding the Erlang/OTP SSH library is potentially vulnerable.
How do I fix CVE-2025-32433?
Update Erlang/OTP to patched versions (27.3.3, 26.2.5.11, or 25.3.2.20). For Cisco products, follow the Cisco Security Advisory. As an interim measure, disable SSH services where not needed and restrict SSH access through firewall rules.
How severe is CVE-2025-32433?
CVE-2025-32433 has the maximum possible CVSS v3.1 score of 10.0 (CRITICAL) with Changed scope. It allows unauthenticated remote code execution on any system running an Erlang/OTP SSH server, with no special conditions or user interaction required. This is one of the most severe vulnerabilities disclosed in recent years.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.