Apr 16, 2025
2 new incidents, 0 with updates.
Started
- ClosedCriticalPatched
Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)
The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.
Erlang/OTP SSHClosed Jun 9, 2025
- ClosedMediumPatched
SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution. Added to CISA KEV on 2025-04-16.
SonicWall SMA100 AppliancesClosed Apr 16, 2025
