CVE-2025-32433: Unauthenticated Remote Code Execution Vulnerability in Erlang/OTP SSH Server

Overview

The Common Vulnerabilities and Exposures (CVE) system has identified a critical security vulnerability, CVE-2025-32433, affecting older versions of Erlang/OTP, a widely-used set of libraries for the Erlang programming language. This vulnerability could enable a malicious actor to execute arbitrary commands on an affected system without valid authentication, potentially leading to system compromise or data leakage. It is significant due to the severity of the potential impact and the widespread use of Erlang/OTP across a myriad of applications and services.

Vulnerability Summary

CVE ID: CVE-2025-32433
Severity: Critical (CVSS 10.0)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Erlang/OTP | Prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20

How the Exploit Works

The vulnerability lies in the SSH server component of the Erlang/OTP libraries. An attacker can exploit a flaw in the SSH protocol message handling to gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This flaw allows for unauthenticated remote code execution (RCE), which could lead to full system control in the hands of an attacker.

Conceptual Example Code

While the specifics of the exploit are not provided to prevent misuse, a conceptual example of an SSH-based exploit might look like this:

ssh -o ProxyCommand='echo -e "malicious_payload\n"' target_user@target_host

In this example, the attacker uses the SSH option `-o ProxyCommand` to launch a malicious payload that exploits the flawed SSH protocol message handling, enabling the attacker to execute arbitrary commands on the target host without valid credentials.

Mitigation and Recommendations

Affected users are strongly advised to upgrade to the patched versions OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 as soon as possible. If immediate upgrade is not possible, a temporary workaround involves disabling the SSH server or preventing access via firewall rules.
Additionally, implementing a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can offer temporary mitigation. However, these measures do not eliminate the vulnerability but can help detect and possibly prevent exploitation attempts.
Remember, the best defense against this and other vulnerabilities is to keep systems and software up-to-date, monitor for suspicious activity, and implement strong, layered security controls.