CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Published Apr 16, 2025
·
Updated

Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.

Other sources

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Debian

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Microsoft

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

Launchpad

Affected Software

54 affected componentsFixes available
debian/erlang<=1:23.2.6+dfsg-1+deb11u1, <=1:25.2.3+dfsg-1
1:23.2.6+dfsg-1+deb11u21:25.2.3+dfsg-1+deb12u11:27.3.3+dfsg-1
Erlang OTP<27.3.3, <26.2.5.11, <25.3.2.20
Erlang Erlang/OTP
Erlang Erlang\/otp<25.3.2.20
Erlang Erlang\/otp>=26.0<26.2.5.11
Erlang Erlang\/otp>=27.0<27.3.3
Cisco Confd Basic<7.7.19.1
Cisco Confd Basic>=8.0.18<8.1.16.2
Cisco Confd Basic>=8.2<8.2.11.1
Cisco Confd Basic>=8.3<8.3.8.1
Cisco Confd Basic>=8.4<8.4.4.1
Cisco Network Services Orchestrator<5.7.19.1
Cisco Network Services Orchestrator>=5.8<6.1.16.2
Cisco Network Services Orchestrator>=6.2<6.2.11.1
Cisco Network Services Orchestrator>=6.3<6.3.8.1
Cisco Network Services Orchestrator>=6.4<6.4.1.1
Cisco Network Services Orchestrator>=6.4.2<6.4.4.1
Cisco Cloud Native Broadband Network Gateway<2025.03.1
Cisco iNode Manager
Cisco Smart Phy<25.2
Cisco Ultra Packet Core<2025.03
Cisco Ultra Services Platform
Cisco StarOS<2025.03
All of the following
Cisco Optical Site Manager<25.2.1
Any of the following
Cisco Ncs 1001
Cisco Ncs 1002
Cisco Ncs 1004
All of the following
Cisco Ncs 2000 Shelf Virtualization Orchestrator Firmware<25.1.1
Cisco Ncs 2000 Shelf Virtualization Orchestrator Module
Cisco Enterprise NFV Infrastructure Software<4.18
Cisco Ultra Cloud Core<2025.03.1
All of the following
Cisco Rv160w Firmware
Cisco Rv160w
All of the following
Cisco Rv260 Firmware
Cisco RV260
All of the following
Cisco Rv160 Firmware
Cisco RV160
All of the following
Cisco Rv260p Firmware
Cisco Rv260p
All of the following
Cisco Rv260w Firmware
Cisco Rv260w
All of the following
Cisco RV340 Firmware
Cisco RV340
All of the following
Cisco Rv340w Firmware
Cisco RV340W
All of the following
Cisco Rv345 Firmware
Cisco RV345
All of the following
Cisco Rv345p Firmware
Cisco RV345P
Debian Debian Linux=11.0
Microsoft cbl2 erlang 25.2-3<25.3.2.20-1
25.3.2.20-1
Microsoft cbl2 erlang 25.3.2.20-1<25.3.2.20-1
25.3.2.20-1
Microsoft azl3 erlang 26.2.5.11-1<26.2.5.11-1
26.2.5.11-1
Microsoft azl3 erlang 26.2.5.9-1<26.2.5.11-1
26.2.5.11-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/erlang to a version that resolves this vulnerability.

    Fixed in 1:23.2.6+dfsg-1+deb11u2Fixed in 1:25.2.3+dfsg-1+deb12u1Fixed in 1:27.3.3+dfsg-1
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 25.3.2.20-1
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 26.2.5.11-1
  4. Upgrade

    Upgrade Erlang/OTP SSH server (Erlang/OTP) to a version that resolves this vulnerability.

    Fixed in OTP-27.3.3
  5. Upgrade

    Upgrade Erlang/OTP SSH server (Erlang/OTP) to a version that resolves this vulnerability.

    Fixed in OTP-26.2.5.11
  6. Upgrade

    Upgrade Erlang/OTP SSH server (Erlang/OTP) to a version that resolves this vulnerability.

    Fixed in OTP-25.3.2.20
  7. Compensating control

    Temporary workaround: disable the SSH server to prevent exploitation of CVE-2025-32433 in Erlang/OTP SSH protocol message handling.

  8. Compensating control

    Temporary workaround: prevent access to the Erlang/OTP SSH server via firewall rules while awaiting the OTP update(s) for CVE-2025-32433.

Event History

Apr 16, 2025
CVE Published
via MITRE·09:34 PM
Data Sourced
via MITRE·09:34 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Apr 17, 2025
News Published
via BleepingComputer·09:34 PM
News Published
via BleepingComputer·09:36 PM
Apr 19, 2025
News Published
via BleepingComputer·02:05 PM
Apr 21, 2025
News Published
via The Register·08:31 PM
News Published
via The Register·08:36 PM
Apr 22, 2025
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Apr 25, 2025
Data Sourced
via Ubuntu·08:27 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·08:29 PM
Description
Jun 9, 2025
Known Exploited
via CISA·12:00 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-32433?

CVE-2025-32433 is classified as a high severity vulnerability due to its potential for unauthenticated remote code execution.

2

How do I fix CVE-2025-32433?

To fix CVE-2025-32433, update your Erlang/OTP installation to versions 27.3.3, 26.2.5.11, or 25.3.2.20 or later.

3

What type of vulnerability is CVE-2025-32433?

CVE-2025-32433 is a remote code execution vulnerability that affects the SSH server functionality in Erlang/OTP.

4

Which versions of Erlang/OTP are affected by CVE-2025-32433?

CVE-2025-32433 affects Erlang/OTP versions prior to 27.3.3, 26.2.5.11, and 25.3.2.20.

5

What might happen if CVE-2025-32433 is exploited?

If CVE-2025-32433 is exploited, an attacker could execute arbitrary code on the server without authentication.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203