https://pwn.watch/t/erlang Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 09 Jun 2025 00:00:00 GMT https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433 https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433 Mon, 09 Jun 2025 00:00:00 GMT critical <p>The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20</p> <p><strong>Latest updates:</strong></p><ul><li>2025-06-09: CISA adds CVE-2025-32433 to KEV</li><li>2025-04-18: Discussion and PoC references on oss-security (<a href="https://openwall.com/lists/oss-security/2025/04/18/2">source</a>)</li><li>2025-04-16: Erlang/OTP publishes advisory GHSA-37cp-fgq5-7wc2 and patched releases (<a href="https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2025-32433</p>