CVE-2025-32433
Erlang — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Erlang · CWE-306 · in CISA KEV since 2025-06-09
EVRS 88 of 100 Immediate
Out-of-Band / Urgent Remediation
Rank 175 of 2,960 tracked
Why it scores 88
Evidence available: 6 of 7 signalsListed in the CISA KEV catalog, and an EPSS probability of 0.988.
- CISA KEVApplied
- RansomwareDid not apply
- Vendor exploitationDid not apply
- EPSSApplied
- Microsoft Exploitability IndexNot applicable
- Pre-patch disclosureNo data
- KEV recencyDid not apply
- CVSSApplied
The band answers “how soon”, not “how bad”. No data for: Pre-patch disclosure. Why some signals show no data
Fix
Patch or fixed version identifiedCISA required action
- This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see
- sec.cloudapps.cisco.com/…/cisco-sa-erlang-otp-ssh-xyZZy
- nvd.nist.gov/…/CVE-2025-32433
Fixed in
erlang -> 1:22.2.7+dfsg-1ubuntu0.5 | erlang -> 1:24.2.1+dfsg-1ubuntu0.4 | erlang -> 1:25.3.2.8+dfsg-1ubuntu4.3 | erlang -> 1:18.3-dfsg-1ubuntu3.1+esm1 | erlang -> 1:20.2.2+dfsg-1ubuntu2+esm1 | erlang -> 1:25.2.3+dfsg-1+deb12u1 | erlang -> 1:27.3.3+dfsg-1
Affected versions
- erlang\/otp
< 25.3.2.20>= 26.0 < 26.2.5.11>= 27.0 < 27.3.3 - confd basic
< 7.7.19.1>= 8.0.18 < 8.1.16.2>= 8.2 < 8.2.11.1>= 8.3 < 8.3.8.1>= 8.4 < 8.4.4.1 - network services orchestrator
< 5.7.19.1>= 5.8 < 6.1.16.2>= 6.2 < 6.2.11.1>= 6.3 < 6.3.8.1>= 6.4 < 6.4.1.1>= 6.4.2 < 6.4.4.1 - cloud native broadband network gateway
< 2025.03.1 - inode manager
- smart phy
< 25.2 - ultra packet core
< 2025.03 - ultra services platform
+28 more affected products; see the full list at NVD.
Remediation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Fixed versions from NVD.
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | 10.0 | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | 0.988 (99.93rd pctl) | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Confirmed | CISA KEV |
| Ransomware campaign useWhether CISA has seen ransomware operators use it. | Unknown or none | CISA KEV |
| CISA remediation deadlineThe date US federal agencies must have fixed or mitigated it. | 2025-06-30 · KEV since 2025 · listed over a year | CISA KEV |
| Public exploit moduleA module existing is not the same as active exploitation. | Public module exists | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 10.0 (v3.1), assigned by GitHub_M. | Listed | ENISA EUVD |
Description
NVDErlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
What CISA says to do
- This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see
- sec.cloudapps.cisco.com/…/cisco-sa-erlang-otp-ssh-xyZZy
- nvd.nist.gov/…/CVE-2025-32433
Public module
Metasploit lists a public excellent-rank module for this CVE: Erlang OTP Pre-Auth RCE Scanner and Exploit (linux/ssh/ssh_erlangotp_rce). A module existing is not the same as active exploitation; see metasploit.com.