CVE-2025-32433: Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Critical severity · published Apr 16, 2025

CVE-2025-32433

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

In wildKEV

10.0

CVSS

98.9%

EPSS

Yes

On KEV

Description

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)98.9% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Jun 9, 2025

Federal remediation dueJun 30, 2025

Ransomware campaign useNot known

Affected products

Which versions

otp · erlang

>= OTP-27.0-rc1, < OTP-27.3.3; >= OTP-26.0-rc1, < OTP-26.2.5.11; < OTP-25.3.2.20 · source: vendor

Cloud Native Broadband Network Gateway · Cisco

before 2025.03.1 · source: NVD

Confd Basic · Cisco

before 7.7.19.1; 8.0.18 before 8.1.16.2; 8.2 before 8.2.11.1; 8.3 before 8.3.8.1; 8.4 before 8.4.4.1 · source: NVD

Debian Linux · Debian

11.0 · source: NVD

Enterprise Nfv Infrastructure Software · Cisco

before 4.18 · source: NVD

Erlang/otp · Erlang

before 25.3.2.20; 26.0 before 26.2.5.11; 27.0 before 27.3.3 · source: NVD, KEV

Inode Manager · Cisco

All versions, or not specified · source: NVD

Ncs 2000 Shelf Virtualization Orchestrator Firmware · Cisco

before 25.1.1 · source: NVD

Network Services Orchestrator · Cisco

before 5.7.19.1; 5.8 before 6.1.16.2; 6.2 before 6.2.11.1; 6.3 before 6.3.8.1; 6.4 before 6.4.1.1; 6.4.2 before 6.4.4.1 · source: NVD

Optical Site Manager · Cisco

before 25.2.1 · source: NVD

Rv160 Firmware · Cisco

All versions, or not specified · source: NVD

Rv160w Firmware · Cisco

All versions, or not specified · source: NVD

In the news

VulnerabilityHigh

Siemens SINEC OS

View CSAF Summary SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SINEC OS are affected: RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2025-1390, CVE-2025-3360, CVE-2025-4138, CVE-2025-4330, CVE-2025-4373, CVE-2025-4435, CVE-2025-4516, CVE-2025-4517, CVE-2025-6141, CVE-2025-9086, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-10148, CVE-2025-27587, CVE-2025-32433, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38345, CVE-2025-38350, CVE-2025-38498, CVE-2025-39839, CVE-2025-39841, CVE-2025-39846, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-59375) SCALANCE XCH328 (6GK5328-4TS01-2EC2) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665...

CVE-2022-48174 CVE-2023-7256 CVE-2023-39810

Feb 12, 2026·CISA Advisories

Affected product

otp

erlang

All otp CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-32433

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-32433

CISA KEV catalogue