Unauthenticated Remote Code Execution in Erlang/OTP SSH Server Before Specified Versions
Erlang/OTP, a set of libraries for the Erlang programming language, contains a critical SSH server vulnerability that allows unauthenticated remote code execution prior to specific version updates. An attacker can exploit a flaw in SSH protocol message handling to gain unauthorized system access and execute arbitrary commands without valid credentials. The vulnerability affects versions before OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. These specific versions include patches that address the security issue. Users can mitigate the risk by updating to the patched versions or implementing temporary workarounds such as disabling the SSH server or blocking access through firewall rules.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
erlang otp |
Public exploits released for critical Erlang/OTP SSH flaw, patch now By Lawrence Abrams April 19, 2025 10:05 AM 0 Public exploits are now available for a critical Erlang/OTP SSH vulnerability tracked as CVE-2025-32433, allowing unauthenticated attackers to remotely execute code on impacted devices. Researchers at the Ruhr University Bochum in Germany disclosed the flaw on Wednesday, warning that all devices running the daemon were vulnerable. "The issue is caused by a flaw in the SSH p...
Critical Erlang/OTP SSH pre-auth RCE is 'Surprisingly Easy' to exploit, patch now By Lawrence Abrams April 17, 2025 05:34 PM 0 A critical vulnerability in the Erlang/OTP SSH, tracked as CVE-2025-32433, has been disclosed that allows for unauthenticated remote code execution on vulnerable devices. The flaw was discovered by Fabian Bäumer, Marcus Brinkmann, Marcel Maehren, and Jörg Schwenk of the Ruhr University Bochum in Germany and given a maximum severity score of 10.0. All dev...
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Erlang? Er, man, no problem. ChatGPT, Claude to go from flaw disclosure to actual attack code in hours Microsoft rated this bug as low exploitability. Miscreants weaponized it in just 8 days
The time from vulnerability disclosure to proof-of-concept (PoC) exploit code can now be as short as a few hours, thanks to generative AI models. Matthew Keely, of Platform Security and penetration testing firm ProDefense, managed to cobble together a working exploit for a critical vulnerability in Erlang's SSH library (CVE-2025-32433) in an afternoon, although the AI he used had some help - the model was able to use code from an already published patch in the library to hunt down which holes ha...
Vulmon