CVE-2025-32433
April 16, 2025
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Affected Packages
https://github.com/erlang/otp.git (GITHUB):
Affected version(s) >=OTP-27.0 <OTP-27.3.3Fix Suggestion:
Update to version OTP-27.3.3https://github.com/erlang/otp.git (GITHUB):
Affected version(s) >=OTP-17.0 <OTP-25.3.2.20Fix Suggestion:
Update to version OTP-25.3.2.20https://github.com/erlang/otp.git (GITHUB):
Affected version(s) >=OTP-26.0 <OTP-26.2.5.11Fix Suggestion:
Update to version OTP-26.2.5.11Related Resources (14)
Do you need more information?
Contact UsCVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
Exploit Maturity
POC
CVSS v3
Base Score:
10
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Exploit Maturity
FUNCTIONAL
Weakness Type (CWE)
Missing Authentication for Critical Function
EPSS
Base Score:
49.91
