{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T22:28:51.438Z",
  "tag": {
    "id": "erlang",
    "label": "Erlang",
    "isStack": false,
    "url": "https://pwn.watch/t/erlang",
    "feed": "https://pwn.watch/t/erlang/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433",
      "title": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)",
      "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433",
      "json": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Erlang/OTP SSH",
      "tags": [
        "erlang",
        "ssh",
        "rce",
        "auth-bypass",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-32433"
      ],
      "affectedVersions": [
        "OTP SSH before OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20"
      ],
      "fixedVersions": [
        "OTP-27.3.3",
        "OTP-26.2.5.11",
        "OTP-25.3.2.20"
      ],
      "startedAt": "2025-04-16",
      "closedAt": "2025-06-09",
      "updatedAt": "2025-06-09",
      "summary": "The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433",
      "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-09",
      "title": "CISA adds CVE-2025-32433 to KEV",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433"
    },
    {
      "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433",
      "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-18",
      "title": "Discussion and PoC references on oss-security",
      "body": null,
      "sourceUrl": "https://openwall.com/lists/oss-security/2025/04/18/2",
      "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433"
    },
    {
      "incident": "erlang-otp-ssh-unauthenticated-rce-cve-2025-32433",
      "incidentTitle": "Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-16",
      "title": "Erlang/OTP publishes advisory GHSA-37cp-fgq5-7wc2 and patched releases",
      "body": null,
      "sourceUrl": "https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2",
      "url": "https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433"
    }
  ]
}