CVE-2025-32433: Erlang/OTP SSH Server RCE Vulnerability

CVE-2025-32433 Overview

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

Critical Impact
Remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands.

Affected Products

Erlang Erlang/OTP
Cisco ConfD Basic
Cisco Network Services Orchestrator

Discovery Timeline

Not Available - Vulnerability discovered by Not Available
Not Available - Responsible disclosure to erlang
Not Available - CVE CVE-2025-32433 assigned
Not Available - erlang releases security patch
2025-04-16 - CVE CVE-2025-32433 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-32433

Vulnerability Analysis

The vulnerability arises from improper SSH protocol message handling, allowing for remote code execution when specially crafted messages are sent to the vulnerable server. This enables the attacker to bypass authentication and run arbitrary commands.

Root Cause

The root cause of this vulnerability is the inadequate validation and parsing of SSH protocol messages.

Attack Vector

This is a network-based attack, wherein the attacker targets the SSH server over the network.

python

# Example exploitation code (sanitized)
import socket

def exploit(ip, port):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((ip, port))
    payload = b"malicious_payload"
    s.send(payload)
    s.close()

exploit('192.168.1.1', 22)

Detection Methods for CVE-2025-32433

Indicators of Compromise

Unusual SSH login attempts from unknown IP addresses
Execution of unauthorized processes
Unexpected changes in SSH server configurations

Detection Strategies

Monitor network traffic for irregular patterns and use intrusion detection systems to identify unusual SSH payloads. Logging SSH connections and commands executed can help in detecting exploitation attempts.

Monitoring Recommendations

Utilize endpoint protection solutions, like SentinelOne, to monitor for anomalous behavior and unauthorized command execution within networks.

How to Mitigate CVE-2025-32433

Immediate Actions Required

Update to the latest versions of OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20.
Disable the SSH server if not in use.
Implement strict firewall rules to prevent unauthorized access.

Patch Information

Patches are available from the official repository and can be directly applied to affected versions to mitigate the risk of exploitation.

Workarounds

As a temporary measure, administrators can disable the SSH service or restrict its accessibility using firewall configurations to mitigate potential risks until the patch is applied.

bash

# Configuration example
echo 'sshd: ALL' >> /etc/hosts.deny