Erlang/OTP SSH Server Unauthenticated Remote Code Execution Vulnerability Advisory (CVE-2025-32433)
Executive & SecOps Summary
SECOPS ASSESSMENTErlang/OTP versions prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20
Unauthenticated remote attackers can exploit a flaw in SSH protocol message handling to execute arbitrary commands and gain full system control without valid credentials
Immediately upgrade Erlang/OTP to patched versions (OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20) or temporarily disable the SSH server and restrict access via firewall rules
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Erlang/OTP environment to the patched versions using your package manager or by rebuilding your container images.
# Upgrade Erlang/OTP on Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade erlang-nox erlang-ssh -y
# Example of pinning the secure version in a Dockerfile
# FROM erlang:27.3.3-alpine2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, disable the SSH server daemon or restrict access using firewall rules.
# Restrict access to the Erlang SSH port (e.g., 2222) using iptables
sudo iptables -A INPUT -p tcp --dport 2222 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 2222 -j DROP
# Disable the SSH daemon in the Erlang application configuration (sys.config)
# {ssh, [{start_daemon, false}]}3. Log Audit & IoC Verification Commands
Verify the currently running Erlang/OTP version and inspect SSH logs for anomalous connection patterns.
# Check the active Erlang/OTP version from the command line
erl -eval 'io:format("Erlang/OTP Version: ~s~n", [erlang:system_info(otp_release)]), halt().' -noshell
# Scan Erlang SSH logs for unexpected connection terminations or authentication anomalies
grep -Ei 'ssh.*(auth_failed|connection_closed|error)' /var/log/erlang/*.logScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-32433) is a critical unauthenticated Remote Code Execution (RCE) flaw residing in the built-in SSH server library of Erlang/OTP. The root cause is a missing authentication validation mechanism (CWE-306) during the processing of specific SSH protocol messages. This architectural flaw allows certain control flows or message handlers to be executed before the client session is properly authenticated, enabling unauthorized actors to bypass security controls.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending specially crafted SSH protocol handshake and control messages to the target Erlang SSH server port. By injecting a malicious sequence of messages during the connection initialization or channel negotiation phase, the attacker tricks the SSH daemon into bypassing the authentication phase or invoking command execution handlers directly. This allows the attacker to execute arbitrary OS commands or inject Erlang shell code with the privileges of the running Erlang runtime process.
3. Infrastructure & Business Impact
With a CVSS score of 10.0 and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability poses an extreme risk to enterprise infrastructure. Erlang/OTP is widely utilized as the underlying runtime for critical distributed systems such as RabbitMQ, CouchDB, and Riak. Successful exploitation can lead to complete compromise of message brokers and databases, resulting in catastrophic data breaches, service disruption, and potential lateral movement within the internal network.
Official Vendor Advisories & References
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Frequently Asked SecOps Questions (CVE-2025-32433)
FAQQ1. How critical is CVE-2025-32433 and is it actively exploited in the wild?
CVE-2025-32433 is rated CVSS 10.0 (CRITICAL) with a 30-day EPSS exploitation probability of 98.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-32433?
Primary impacted vendors include erlang across erlang/otp. Scope summary: Erlang/OTP versions prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20 (when the SSH server module is enabled)
Q3. What temporary mitigations or workarounds exist for CVE-2025-32433 before patching?
[Mitigation] Immediately upgrade Erlang/OTP to patched versions (OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20) or temporarily disable the SSH server and restrict access via firewall rules Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-32433
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (erlang)
View Category →marimo Reactive Python Notebook Pre-Auth Remote Code Execution (RCE) via Terminal WebSocket Authentication Bypass (CVE-2026-39987)
[Affected Scope] All versions of marimo open-source Python notebook prior to 0.23.0
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.