Erlang OTP SSH Server improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in Erlang OTP. Affected is an unknown function of the component SSH Server. This manipulation causes improper authentication. This vulnerability appears as CVE-2025-32433. The attack may be initiated remotely. In addition, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Erlang OTP (affected version not known) and classified as very critical. Affected by this vulnerability is some unknown functionality of the component SSH Server. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

The weakness was presented by Fabian Bäumer. The advisory is shared at seclists.org. This vulnerability is known as CVE-2025-32433 since 04/08/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but an exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/09/2025).

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 234684 (Debian dla-4132 : erlang - security update), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 06/09/2025 with a due date of 06/30/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (234684). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Erlang

Name

• OTP

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion