# Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433) · pwn.watch

> The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.

Page: https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433 · generated 2026-10-23T04:59:28.006Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: Erlang/OTP SSH
- Started: 2025-04-16 · closed: 2025-06-09
- CVEs: CVE-2025-32433
- Affected: OTP SSH before OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20
- Fixed in: OTP-27.3.3; OTP-26.2.5.11; OTP-25.3.2.20

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433/feed.xml
- JSON Feed: https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433.json
- This file: https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433/llms.txt

## Updates (newest first)
- 2025-06-09: CISA adds CVE-2025-32433 to KEV
- 2025-04-18: Discussion and PoC references on oss-security (https://openwall.com/lists/oss-security/2025/04/18/2)
- 2025-04-16: Erlang/OTP publishes advisory GHSA-37cp-fgq5-7wc2 and patched releases (https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2)

## Fix brief
# Security brief: Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)

Source: https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433 · status: closed (closed Jun 9, 2025) · severity: critical · updated Jun 9, 2025

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.

Severity detail: CVSS 10.0; unauthenticated RCE; CISA KEV

- Product: Erlang/OTP SSH
- CVE / advisory ids: CVE-2025-32433

## Affected versions
- OTP SSH before OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- OTP-27.3.3
- OTP-26.2.5.11
- OTP-25.3.2.20

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Jun 9, 2025: CISA adds CVE-2025-32433 to KEV
- Apr 18, 2025: Discussion and PoC references on oss-security
- Apr 16, 2025: Erlang/OTP publishes advisory GHSA-37cp-fgq5-7wc2 and patched releases

## Advisories
- [Unauthenticated Remote Code Execution in Erlang/OTP SSH (GHSA-37cp-fgq5-7wc2)](https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2) (Erlang/OTP)
- [OTP 27.3.3](https://github.com/erlang/otp/releases/tag/OTP-27.3.3) (Erlang/OTP)
- [Patch Package OTP 26.2.5.11 Released](https://erlang.org/pipermail/erlang-announce/2025-April/000308.html) (Erlang/OTP)
- [NVD: CVE-2025-32433](https://nvd.nist.gov/vuln/detail/CVE-2025-32433) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Caveats
Advisory date 2025-04-16 is from the public disclosure; verify on the GitHub advisory.

---
Machine-readable: https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.