[Solved] CVE-2025-32433: Critical SSH Vulnerability in Erlang/OTP

CVE-2025-32433: Critical SSH Vulnerability in Erlang/OTP

In April 2025, a serious vulnerability—identified as CVE-2025-32433—was disclosed in the SSH server component of Erlang/OTP, a platform widely used in telecommunication, distributed systems, and messaging infrastructures like RabbitMQ and CouchDB. This vulnerability, rated with a CVSS score of 10.0, the highest possible, exposes systems to unauthenticated remote code execution (RCE), making it one of the most severe flaws disclosed in recent years.

What is CVE-2025-32433?

CVE-2025-32433 is a missing authentication vulnerability found in the SSH server implementation within Erlang/OTP. The flaw resides in the way the server processes certain SSH messages before user authentication is completed. Specifically, it allows a malicious actor to send specially crafted SSH messages that bypass the authentication phase entirely, giving them the ability to execute arbitrary commands on the host system. This behavior violates RFC 4252, which outlines SSH authentication protocols, and creates a direct path to system compromise without any credentials.

When Was It Discovered?

The vulnerability was officially disclosed on April 16, 2025 by the Erlang/OTP maintainers. By early June 2025, it had been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog, indicating that the vulnerability had been actively exploited in the wild. Security researchers and CERT teams began observing abnormal SSH traffic patterns and unauthorized system access attempts that aligned with this flaw’s exploit signature.

Exploitation in the Wild

Following its disclosure, exploitation activity surged, especially targeting telecom devices, cloud-based messaging queues, and embedded systems where Erlang/OTP is commonly deployed. Attackers took advantage of the flaw to run backdoors, install malware, or pivot into more sensitive areas of the network. Because Erlang-based services often run with elevated privileges, successful exploitation often resulted in full system compromise.

Who is Affected?

This vulnerability affects the following Erlang/OTP versions:

• OTP ≤ 27.3.2
• OTP ≤ 26.2.5.10
• OTP ≤ 25.3.2.19

Organizations using the SSH server component in Erlang/OTP in any capacity are at risk, including:

• Telecom providers using Erlang for high-availability infrastructure
• Cloud-native applications like RabbitMQ and CouchDB
• IoT and embedded devices bundled with Erlang runtime
• Linux distributions like Alpine that include Erlang packages

How to Fix CVE-2025-32433

The Erlang/OTP development team has released patches to address this vulnerability. The issue is resolved in the following versions:

• OTP 27.3.3
• OTP 26.2.5.11
• OTP 25.3.2.20

To fix the vulnerability, users should:

1. Immediately upgrade to the relevant patched version.
2. If upgrades are not feasible, disable the SSH server within Erlang/OTP temporarily.
3. Use network firewalls to restrict access to the vulnerable SSH service.
4. Monitor logs for any suspicious access or behavior related to Erlang’s SSH server.

Detection and Mitigation

Security teams should look for anomalous SSH connections, especially those where authentication does not appear in logs but is followed by system-level actions. Endpoint monitoring solutions and intrusion detection systems should be updated to include signatures for this exploit.

Regulatory Advisory

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its KEV catalog, requiring federal agencies and contractors to patch the vulnerability by June 30, 2025. This mandate is based on BOD 22-01 and reflects the critical nature of this exploit.

Staying Secure

To maintain a secure environment, all users of Erlang/OTP should:

• Stay updated with the latest security patches
• Limit external SSH exposure
• Segment networks and isolate critical services
• Regularly audit SSH and service access logs

Conclusion

CVE-2025-32433 highlights the importance of secure authentication handling, especially in core networking services like SSH. Given its high severity and widespread use of Erlang/OTP, urgent action is necessary to patch systems, reduce attack surfaces, and monitor for exploit activity. The discovery and exploitation of this vulnerability underscore the value of proactive security monitoring and rapid patch deployment.

Stay tuned to FixTheRisk.in for future updates, threat analysis, and in-depth vulnerability insights.