CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.
Other sources
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
— Debian
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
— Microsoft
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/erlangto a version that resolves this vulnerability.Fixed in 1:23.2.6+dfsg-1+deb11u2Fixed in 1:25.2.3+dfsg-1+deb12u1Fixed in 1:27.3.3+dfsg-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.3.2.20-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.11-1 - Upgrade
Upgrade
Erlang/OTP SSH server (Erlang/OTP)to a version that resolves this vulnerability.Fixed in OTP-27.3.3 - Upgrade
Upgrade
Erlang/OTP SSH server (Erlang/OTP)to a version that resolves this vulnerability.Fixed in OTP-26.2.5.11 - Upgrade
Upgrade
Erlang/OTP SSH server (Erlang/OTP)to a version that resolves this vulnerability.Fixed in OTP-25.3.2.20 - Compensating control
Temporary workaround: disable the SSH server to prevent exploitation of CVE-2025-32433 in Erlang/OTP SSH protocol message handling.
- Compensating control
Temporary workaround: prevent access to the Erlang/OTP SSH server via firewall rules while awaiting the OTP update(s) for CVE-2025-32433.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32433?
CVE-2025-32433 is classified as a high severity vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2025-32433?
To fix CVE-2025-32433, update your Erlang/OTP installation to versions 27.3.3, 26.2.5.11, or 25.3.2.20 or later.
What type of vulnerability is CVE-2025-32433?
CVE-2025-32433 is a remote code execution vulnerability that affects the SSH server functionality in Erlang/OTP.
Which versions of Erlang/OTP are affected by CVE-2025-32433?
CVE-2025-32433 affects Erlang/OTP versions prior to 27.3.3, 26.2.5.11, and 25.3.2.20.
What might happen if CVE-2025-32433 is exploited?
If CVE-2025-32433 is exploited, an attacker could execute arbitrary code on the server without authentication.