ClosedPatched

Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)

Erlang/OTP SSH

The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.

Why this severity: CVSS 10.0; unauthenticated RCE; CISA KEV

Started: Apr 16, 2025
Closed: Jun 9, 2025
CVE: CVE-2025-32433

Follow this incident

Updated Jun 9, 2025

Affected

OTP SSH before OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20

Fixed in

OTP-27.3.3
OTP-26.2.5.11
OTP-25.3.2.20

Timeline3

Jun 9, 2025
CISA adds CVE-2025-32433 to KEV
Apr 18, 2025
Discussion and PoC references on oss-security
Source
Apr 16, 2025
Erlang/OTP publishes advisory GHSA-37cp-fgq5-7wc2 and patched releases
Source

Advisories5

Notes & caveats

Advisory date 2025-04-16 is from the public disclosure; verify on the GitHub advisory.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified