Read the docs
TI-2025-23504 Aliases CVE-2025-32433

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Priority CRITICAL 100Exploited in the wildCWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Why it matters now

Exploitation Active In CISA KEV since 2025-06-09CISA due date 2025-06-30
EPSS 0.98924 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Erlangotp>= OTP-27.0-rc1, < OTP-27.3.3; >= OTP-26.0-rc1, < OTP-26.2.5.11; < OTP-25.3.2.20—No fix listedCNA
  • otp VendorErlang Affected >= OTP-27.0-rc1, < OTP-27.3.3; >= OTP-26.0-rc1, < OTP-26.2.5.11; < OTP-25.3.2.20 Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*before 25.3.2.20; 26.0 to before 26.2.5.11; 27.0 to before 27.3.3VulnerableErlang
cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:*before 7.7.19.1; 8.0.18 to before 8.1.16.2; 8.2 to before 8.2.11.1; 8.3 to before 8.3.8.1; 8.4 to before 8.4.4.1VulnerableCisco
cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:*before 5.7.19.1; 5.8 to before 6.1.16.2; 6.2 to before 6.2.11.1; 6.3 to before 6.3.8.1; 6.4 to before 6.4.1.1; 6.4.2 to before 6.4.4.1VulnerableCisco
cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:*before 2025.03.1VulnerableCisco
cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:*before 25.2VulnerableCisco
cpe:2.3:a:cisco:ultra_packet_core:*:*:*:*:*:*:*:*before 2025.03VulnerableCisco
cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*before 2025.03VulnerableCisco
cpe:2.3:a:cisco:optical_site_manager:*:*:*:*:*:*:*:*before 25.2.1VulnerableCisco
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions before 25.3.2.20; 26.0 to before 26.2.5.11; 27.0 to before 27.3.3 Vulnerable ·Erlang
  • cpe:2.3:a:cisco:confd_basic:*:*:*:*:*:*:*:* Versions before 7.7.19.1; 8.0.18 to before 8.1.16.2; 8.2 to before 8.2.11.1; 8.3 to before 8.3.8.1; 8.4 to before 8.4.4.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:network_services_orchestrator:*:*:*:*:*:*:*:* Versions before 5.7.19.1; 5.8 to before 6.1.16.2; 6.2 to before 6.2.11.1; 6.3 to before 6.3.8.1; 6.4 to before 6.4.1.1; 6.4.2 to before 6.4.4.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:cloud_native_broadband_network_gateway:*:*:*:*:*:*:*:* Versions before 2025.03.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:inode_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:a:cisco:smart_phy:*:*:*:*:*:*:*:* Versions before 25.2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ultra_packet_core:*:*:*:*:*:*:*:* Versions before 2025.03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ultra_services_platform:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:* Versions before 2025.03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:optical_site_manager:*:*:*:*:*:*:*:* Versions before 25.2.1 Vulnerable ·Cisco
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware:*:*:*:*:*:*:*:*before 25.1.1VulnerableCisco
cpe:2.3:h:cisco:ncs_2000_shelf_virtualization_orchestrator_module:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*before 4.18VulnerableCisco
cpe:2.3:a:cisco:ultra_cloud_core:*:*:*:*:*:*:*:*before 2025.03.1VulnerableCisco
cpe:2.3:o:cisco:rv160w_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv260_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv160_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv260p_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv260w_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv340_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv340w_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv345_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv345p_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:ncs_2000_shelf_virtualization_orchestrator_firmware:*:*:*:*:*:*:*:* Versions before 25.1.1 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:ncs_2000_shelf_virtualization_orchestrator_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:* Versions before 4.18 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:ultra_cloud_core:*:*:*:*:*:*:*:* Versions before 2025.03.1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:rv160w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv160w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv260_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv260:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv160_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv160:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv260p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv260p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv260w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv260w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv340_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv340w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv345_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv345p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2025-06-09 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-32433

References

Exploit 1

Patch 3

Advisory 4

  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2017-14604 The Erlang otp TLS server answers with different TLS alerts to different error types in… CVSS 3.0MEDIUM 5.9
  • TI-2026-36669 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CVSS 4.0HIGH 8.8
  • TI-2022-17230 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a… CVSS 3.1CRITICAL 9.8
  • TI-2016-08327 An issue was discovered in Erlang/OTP 18.x. CVSS 3.0CRITICAL 9.8
  • TI-2026-42391 Denial of service via exponential certificate policy tree growth in path validation CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences